Swift and Easy Banking Experience!

FİBABANKA ANONİM ŞİRKETİ

PRIVACY NOTICE FOR CUSTOMERS / POTENTIAL CUSTOMERS

As Fibabanka A.Ş. (“Company” or “Fibabanka”), in our capacity as the data controller, we exercise the utmost diligence in processing and protecting the personal data of you, our customers, and prospective customers who will make use of products or services, in accordance with the Law no. 6698 on Protection of Personal Data (“LPPD”) and its secondary regulations (jointly, the “PDP Law”).

By this Privacy Notice, we would like to inform you regarding the personal data processing activities performed by our Company with regards to you, as our customers and potential customers.

Your personal data as specified below ("your personal data") is collected and processed by our Company in connection with the performance of contracts and the requirements of the services to be provided to you, and is obtained and processed through automated and non-automated methods, in physical or electronic environments, either electronically, verbally, or in writing, in a manner that is relevant, limited, and proportionate to the purposes listed below, and in compliance with the principles of the LPPD and in compliance with the PDP Law.

This Privacy Notice has been prepared so as to include the legal grounds stipulated by law as regards the personal data processed in connection with all products and/or services provided to you by our bank.

The personal data that will be processed as part of the products and/or services offered by our Bank are as follows:

1. YOUR PROCESSED PERSONAL DATA

Identity information (name, surname, Turkish Republic identification number (TR ID), foreign identification number, tax identification number, foreign country tax identification number, signature, nationality, title, parents’ names, date of birth, country information, tax office information, United States (“USA”) tax identification number, US citizenship status, potential tax number, citizenship information, tax residency information, place of birth, passport number, passport details, gender, age, maiden name, identity document serial number, identity document order number, identity document issuance date, mother’s maiden name, marital status, identity document type and number, identity document active/inactive status, license information, identity document expiration date, place of identity document issuance, status of the policyholder, military service status, declaration number, registration number, country of birth)

Communication information (address, phone number, email address, title, company name, fax number, address code (UAVT code, National Address Database Code), residence information, workplace address, operator information, KKB contact information, city information, place of residence)

Location information (location information, deed location information)

Financial information (account details, international bank account number (“IBAN”), salary information, balance details, safe deposit box contents, foreign currency amount, estimated assets, asset source, asset-related description, monthly net income, income source, transaction purpose, pricing details, transaction date, transaction value date, transaction amount, debt information, vehicle registration details, title deed information, asset details, loan information, overdue principal amount, vehicle details, encumbrance details, collateral details, risk details, account balance, risk amounts, commission details, derivative information, immovable property details, details of owned immovable property, credit card details, credit card number, electronic funds transfer (“EFT”)/remittance transaction details), Receivables information, credit allocation fee information, ratings, scoring details, credit information - accounts where the individual is in a debtor position, limit information by source, risk information by source, loan type, account information by loan type, collateral provided (debtor), collateral guaranteed (guarantor), legal entity shareholders and partners, individual shareholders, dishonored check information, tax authority (Revenue Administration, "RA") information, exemption limit, blocked account total balance, concentration limit, concentration ratio, total risk, available collateral, account number, classification note, branch information, branch name, risk status, history observation details, number of days overdue, range of overdue payment amount, risk range, credit status, upper limit type, lower limit type, cash risk, limit type, loan type, credit reference, branch code, purpose of use, disbursed amount, value date, maturity date, cash loan information, total disbursed amount, cash loan selection information, Interest information, interest detail information, swap type, swap status, reason for return, collateral amount, collateral type, collateral status, custody branch, collateral inquiry information, general collateral information, pledge details, receivable details, fiscal period-end balances, customer segment, total limit, total risk, group risk, number of days overdue, real estate information, real estate title deed information, real estate encumbrance information, real estate location information, main property features, independent section features, current zoning status, valuation information, occupancy permit information, energy performance certificate information, loan amount, loan maturity, loan repayment plan, Kredi Kayıt Bürosu ("KKB") rating, Personal Debt Index ("BBE") rating, payment information, Loan issuance date, loan limit, installment, remaining debt, total number of records, total limit amount, number of open records, open limit amount, total installments, total remaining debt, product type, product, sub-product type, application status, channel, amount, application date, reason for removal, year of removal, promissory note amount, loan product type, request outcome, request amount, allocation amount, request date, request outcome date, reason for request rejection, protested promissory note information, combined information, bank warning list, non-performing loans, loans held with the bank, individual limit risk inquiry, foreclosure information, ownership status of the house of residence, duration of residence at the address, total monthly income, income source, income owner, loan purpose, income document details, crop information, Social Security Institution ("SGK") employment statement information, Information on the most recent monthly payslip, product information, transaction limits, transaction authorities, available limit information, card number, card status, account transactions, branch, channel, financial control industry code, industry code, chamber registration number, tax type, Central Registration System (“MERSIS”) number, profit center, portfolio code, customer status, registration date, Statistical classification of economic activities in the European Community (“NACE”), product code, transaction code, description, transaction reference, original amount, net debt, total debt, net receivables, total receivables, total balance, customer type, account limit, interest amount, interest tax, discount date, negative discount amount, limit amount, accounting records, cash inflows and outflows, deposit information, close monitoring details, loans under close monitoring, deferred loans, loans with anticipated classification change, legal proceedings status, legal proceedings collections, nonperforming loan sales (“NPL”), assets to be disposed of, placement (investment) and funding details, loan delinquency information, reference, General Ledger ("GL") account number, discount GL account number, contract type, account opening date, number of maturity days, days remaining until maturity, maturity range, last payment date, last interest date, main group code ("GR"), stock exchange income information, mobile phone insurance information, limit reference, status, status code, tax amount paid, total principal information, loan-issuing branch, loan number, loan account code, loan risk weight, loan opening date, original loan maturity, loan renewal maturity, loan proceedings date, loan interest rate, loan currency code, internal rating, loan class, province code, loan source, loan purpose, segment, guarantee amount, disbursed loan amount, indemnity amount, collateral amounts, indemnity claim from the Credit Guarantee Fund ("CGF"), account code, financing subject code, approach code, contract date, maturity date, interest rate, index, collateral amounts, contract amount, payments made, principal, contract code, loan nature, loan class, pre-restructuring loan class, internal rating, credit rating agency, financial restructuring contract number, payment nature, loan repayment amount, current principal amount of the loan, loan maturity date, loan financing subject code, rationale, loan opening date, loan pricing period, loan interest structure, currency code, original currency amount, reference interest rate, counter currency code, deposit, discount amount, current market value, sub-type code, option condition, original currency amount change, market where the transaction took place, foreign exchange transfer code (Society for Worldwide Interbank Financial Telecommunications "SWIFT"), Unit code executing the transaction, transaction number, purpose of the transaction, collateral portfolio, customer limit, derivative transaction limitation, general customer, qualified investor information, professional customer information, counterparty transaction purpose, interest spread, loan unpaid installment date, primary activity code, rating board, date of becoming a bank customer, Anti- Money Laundering ("AML") risk rating, security verification method ("3D Secure"), card type, card expiration date, card delivery type, card delivery branch information, PIN delivery type, PIN delivery branch information, customer group, customer number ("CIF"), Monthly income, annual income, tax residency information, credit and risk information, cryptocurrency movements, cryptocurrency transaction volume, cryptocurrency account information, cryptocurrency balance, average monthly income, average monthly transaction count, average monthly transaction volume, payment instrument information, contribution share information, collateral reference, collateral type, maturity date, tax office, share amount, stake, project investment information, facility appraisal information, participation share, limit, short-term risk, medium-term risk, long-term risk, total risk, group information, company code, reliability status, limit name, customer activity risk, customer project risk, reason for valuation, request type, request category, debt breakdown information, sale date, title deed date, appraisal amount, purchase price, sale price, difference, purchase type, appraisal at the time of proceedings in the system, appraisal date in the system, enforcement/court valuation, enforcement/court valuation date, updated appraisal before auction, appraisal date before auction, total purchase cost, purchase date, post-purchase appraisal, post-purchase appraisal date, sale date, credit risk ("CR") date, principal and charges of credit risk, current proceedings status, assignment balance, date of collection in the system, post-collection current risk date, post-collection current risk (principal + expense), activation date, amount, vefa information, real estate type, internet sales status, deposit balance, currency type, turnover information, collection date, investment funds, balance information as of the deposit commitment date, last update, KKB inquiry date, reason for KKB not being calculated, field of activity, general limit, general risk, cash limit, agricultural limit, non-cash limit, non-cash risk, agricultural risk, workplace ownership status information, limit revision date, total amount, risk amount distribution, risk group code, risk type, country code, asset size, number of employees, risk group name, default period, default amount, loan type, amount collected from default, write-off amount, current loan balance, vehicle registration, debt movement information, card expiration date, card verification code (‘’CVC’’), card validation value (‘’CVV’’), Card number, transaction type, transaction description, loan disbursement amount, deposit transaction information, indebtedness information, scoring type, reference number, rating range, customer risk range, internal rating score, early warning system ("EWS") score, number of EWS criteria, requested loan amount, internal rating, application outcome, rejection reason, current delinquency status of open accounts, current limit utilization ratio (overdraft deposit account & credit card), account duration, KKB commercial credit score, accrued loan amount (last 1 year), NPL (non-performing loan) status (with the bank), current delinquency status (with the bank), existing collateral, current currency type, current maximum maturity, current limit amount, current risk, loan code, bank branch, remaining risk, maturity, loan principal period risk, monthly point of sale ("POS") volume information, POS serial number, POS terminal number, POS merchant number, customer general limit summary, current risk information, approved collateral conditions, segment, group code/name, credit rating ("rating"), general limit summary, collateral summary, collateral conditions, disbursement conditions, limit details, guarantee limit details, credit line offer history, Finecus Avra (rating platform) rating score, group rating score, limit-risk information with the bank, credit performance information with the bank, total capital amount, securities information, investments, financial analysis, profit or loss information, cash flow information, financial details, overdue amount, account information and account transactions with other banks the customer works with, IBAN information with other banks the customer works with, product information held with other banks the customer works with, FX transaction information, FX income, FX transaction volume, assignment dates to law firms, protocol details with delinquent customer, legal proceedings details, Kiraz balance, Limit Control System (“LCS”) inquiry information, payment performance, trade registry information, protected deposit ownership information, fund size, fund transaction information, Private Pension System (BES) insurance income information, fund income information, securities income information, derivative income information, deposit income information, product training, source of assets, remaining partnership share, partnership entry date, entry date to the partner company, remaining number of partners, beneficial owner information, partner/authorized individual joint/individual information, representative type, signature circular reference date, authorization amount, customer receivables invoice number, customer receivables invoice amount, customer receivables invoice information)

Employee personnel information (title, company details, education information, customer type, whether the individual is a Fibabanka employee, profession details, working method, registration number, education level, department, income profit center, customer profit center, customer segment, details about the workplace, employment start date, termination date, profession code, profession name, CV information)

Visual and voice records (photograph, audio recording, video recording, camera recordings, video banking recordings, call center recordings, real estate images, customer meeting recording)

Customer transaction information (customer CIF number, balance information at other banks, transaction amount, transaction description, transaction cost, currency type, currency amount, message details, payment source, payment purpose, branch code, lease agreement date, safe deposit box number, safe deposit box visit information, initial opening/update/safe deposit box closure information, update transaction details, safe deposit box closure date, joint safe deposit box information, hold information, channel information, customer acquisition source, delinquency information, customer acquisition channel, customer status), Customer segment, customer onboarding date, customer status, profit center information, portfolio code, transaction details, customer product trend information, reference number, customer account number, loan information, loan offer information, quarterly non-interest income information, fund transaction information, FX transaction information, cryptocurrency transaction information, insurance activity status, customer credit line information, limit information, group information, industry code information, credit rating, collateral information, collateral ratio, collateral type, flow type, flow category, information regarding the outcome of the complaint process, policy details, policy number, distribution channel/branch information, insurance term, policy start-end date, annual premium information, number of installments, premium installment count, premium payment due date, premium payment amount, premium payment method, insurance coverage details, inheritance information, probate details, new ID ownership status, cash loan information, non-cash loan information, collection details, liquidation details, delinquency details, legal proceedings status, customer number, check/promissory note information, transaction related to the complaint, total check deposits, risk covered by checks, total risk covered by checks, check amount, check amount considered as eligible collateral, check endorsement details, customer group, customer type, check branch, KKB check rating, check report, summary of check information, amounts of issued checks, Open check information, post-dated check information, nearest due date check information, checks where the report holder is the bearer or the last endorser, dishonored check information, legal dispute check information, individual check inquiry, application number, applicant number, invoice information, subscriber number, customer registration number, username, password, Near Field Communication (“NFC”) ownership status, last received error message, check issuer's name/surname, check endorser's name/surname, check guarantor's name/surname, signature of the check issuer, title of the check drawee, customer information, account information, customer code, product information, profit/loss information, Assets Under Management (“AUM”) information, Countly category and page information, Growth-Oriented Marketing (“GOM”) activity information, Risk group code, country code, industry code and offshore code, transaction type code, transaction serial number, transaction date, transaction time, transaction type, transaction identification number (“ID”), transaction result, card number, debit card ownership, EFT statuses, incoming channel, Kiraz ownership information, customer onboarding date, previous status information, customer trend, latest status information, card limit, cash advance limit, statement date, debt information, interest information, installment information, card information, additional card information, owned product information, transaction details, customer transaction channel, customer criteria information, spending information, tax information, fee information, income information, expense information, credit card details, foreign currency transaction information, precious metal transaction information, alert information, order information, capital market transaction details, beneficiary information, designated beneficiary share, payment and deduction information, collateral amounts, insurance start date, Insurance end date, application issuance date, collateral information, premium amount, payment details, insurance renewal information, policy renewal year, language preference, customer transaction activities, information regarding the outcome of the complaint process, customer feedback, net promoter score (“NPS”), complaint/request details, last viewed screen, number of sessions, session duration, session start time, session end time, viewed page, page visit sequence, page view frequency, page view order, page visit frequency, transaction execution time, time of transaction record in the database, session date, session ID, number of transactions, transaction amount, check limit, check risk, annual contribution amount, contribution payment method/payment frequency, entry fee amount/payment frequency, installment entry fee amount, contribution payment start date, deferred exit entry fee amount, endorsement start date, endorsement issuance date, endorsement number, Financial Services Manager (“FSM”) information, Hold information, transaction/observation details, transaction authorizations, deferred exit fee amount, fund name, fund code, contribution share fund ratios, total fund expense (daily), total fund expense (annual), management fee deduction rate, interruption deduction details, participant customer number, contract number, contract type, Individual Pension System (“BES”) entry date, BES account number, selected retirement plan/number, effective date, proposal signature date, BES lump-sum payment amount, policy registration number, plan name, Health Insurance Information and Monitoring Center (“SAGMER”) tariff number, policy start date, policy end date, policy term, renewal number, serial number, general terms date, special terms date, endorsement start date, endorsement issuance date, endorsement number, net premium, Banking and Insurance Transactions Tax (“BSMV”) information, Gross premium, payment plan, installment number, installment amount, payment type, title deed information, tariff price, premium, insurance policy number, issuance place, issuance time, Natural Disaster Insurance Institution (“DASK”) policy number, risk address, activity subject, insurance subject, payable premium, insurance value/limit, insurance premium, insurance price, previous policy number, policy serial number, policy issuance date and time, policy issuance place, reference date, agent number, additional document number, insurance start date, insurance end date, discount information, vacancy period, DASK information, insured building value, total gross premium, method of insurance premium collection, exemption details, previous policy number, insurance coverage information, payment due date, payment amount, coverage start date, coverage end date, coverage name, coverage amount, tariff name, report group, product group, policy status, payment period, start date, end date, first premium amount, coverage code, user type, renewal information, branch code, product code, card status, card delivery type, card delivery branch details, PIN delivery type, PIN delivery branch details, reason for card issuance, initial card acquisition date, cargo tracking number, shipping date, shipment transaction details, Workplace POS number, Bankalararası Kart Merkezi A.Ş. (“BKM”) workplace number, POS name, terminal type, POS establishment date, value date calculation, group code, category code, transaction record, buying/selling details, transaction type, fund information, commercial transaction date, transaction status, value date, exchange rate, bank selling currency, bank selling amount, bank buying currency, bank selling amount, foreign currency amount, tax amount, transaction source, transaction details, receipt number, voucher number, bank partnership information, registration date, invoice amount, representation form for the transaction, type of goods, expense details, commission amount, reference information, pool information, Financial Services Manager (FHY) information, hold information, portfolio information, product reference number, Credit Guarantee Fund (KGF) application number, operation dates, remittance amount, foreign currency code, transaction/observation details, transaction authorizations, time information, annual spending information, transaction number, bank involved in the transaction, bank details for the transfer, transaction code, transaction content, risk amount, total tax amount, total expenses, total commission amount, number of days overdue, payment date, currency, amount of money, U.S. dollar (USD) equivalent, Maturity information, application result information, reason for application cancellation, reason for application rejection, tariff information, commission information, penetration rate, insurance details, payment method, payment channel, error log, banks with open and/or closed check accounts, precautionary check information, group number, number of dishonored checks, indebtedness amount (including post-dated checks), check rating, customer representative, loan type, loan amount, payment plan type, monthly loan repayment amount, payment plan, Overdraft Deposit Account ("KMH") / Hızlı Para limit, payment date, account statement channel preference, loan limit, KMH / Hızlı Para number, application type, interest accrual date, statement preference, statement channel preference, loan application number, real estate information, payment plan type, payment date, monthly loan repayment amount, loan maturity, installment date, insurance premium amount, total amount to be repaid, loan disbursement date, remaining principal amount, payment date, total loan cost, product details, product amount, gold amount, transfer amount, securities/deposit information, outstanding principal loan debt amount, new terms related to the loan, loan number, principal amount, outstanding balance, commission amount/rate, loan disbursement amount, reason for incorrect entry, number of incorrect entries, reference code, complaint/request registration date, credit and risk information, non-payment date, reason for non-payment, debt information, commitment details, balance information at other banks the customer works with, transaction dates at other banks, transaction types at other banks, transaction channels at other banks)

Professional experience information (profession details, education level, university attended, farming certificate, title, years of experience in the industry, work experience details, workplace information, professional status/workplace, working method, duration of employment at the workplace, industry code information, field of activity, limit information, line of business, experience in the industry code).

Transaction security information (Fiba key, e-signature, transaction logs ("log"), internet protocol (“IP”) address information, session information, connection type information, browser information, traffic data, File Transfer Protocol (“FTP”) information, device ID, device information, whether a call is received on the device where the mobile banking application is installed, operator information, banking password, card PIN, verification code, user password, screen size, operating system information, operating system version, application version, application permission information, records on malware behavior, user actions, mobile application usage statistics, internet banking login - logout and transaction history information, internet banking behavioral data, SIM card block information, mobile application password, system login source, device type, one-time password (“OTP”) information, OTP paired device information, screen size, email recipient information, communication start and end time, verified SMS information, other application information)

Legal transaction information (dispute details, information in correspondence with judicial authorities, receivable amount, receivable description, information in enforcement files, initiation date of proceedings, type of proceedings, amount of proceedings, liquidation date, collection details, fee information, collection type, notification date, liquidation date, lien information, payment amount, payment date, court information, case type, case amount, legal status, risk status, debtor type, receivable description, receivable item details, maturity date, interest type, interest start date, interest amount, receivable amount, claimed receivable, remaining amount, official correspondence, informal correspondence, approximate overdue balance, offset option, reason for debt, method of enforcement, attorney fee details, exemptions, case initiation date, vehicle pledge, cash pledge, concordat status, National Judiciary Informatics System (“UYAP”) inquiry/record, e-lien information/status, NRIS (enforcement information), person's status (fraudster, suspect, victim), case content, dispute details, contract type, case details)

Other (account book sending option, check/promissory note payment date, check/promissory note issuance date, check/promissory note issuance place, check/promissory note amount, branch information, bank information, promotion amount, Gold Card (credit card) number, printed express card request, donation amount, document barcode, delivery preference channel, statement delivery information, bank card preference, Foreign Account Tax Compliance Act (FATCA) information, Common Reporting Standard (CRS) information, Alternative Transaction Channels (Multilateral Trading Facility, MTF) risk factors information), MTF/customer relationship start information, MTF transaction date, military service status, bank partnership information, response/defense content, guarantee information, guarantor details, lien information, auction ban information, reference number, disqualification information, application status, rejection reasons, cancellation reason, dealer code, communication language, residence status, reference, information contained in official institution correspondence, case, loss information, notification content, notification status, suspicious transaction information, social media account username, follower count, call duration, call outcome, call history, partnership information, workplace details, finding explanation, message type, provision amount, provision number, tax amount, degree of relationship with the transacting party, salary, tax office information, beneficiary details, tax residency information, guarantee type, guaranteed amount, spouse information, encumbrance details (mortgage), pledge amount, vehicle license plate, vehicle brand, vehicle model, vehicle type, vehicle category, pledge information on the vehicle, International Securities Identification Number (“ISIN”) code, issuance date, issuance maturity, issuance amount, product amount, subject of the debt, debt amount, pledge information, currency to be paid, maximum pledge amount, details of the pledged asset, guarantee date, guarantee amount, guarantee type, pledge type, registration document serial number, registration reference number, Revenue Administration (RA) record, customer complaint record, communication start and end time, call time range, usage habits related to products and services, serial number/IMEI (“International Mobile Equipment Identity”) of the product purchased with credit, product type purchased with credit, product brand, product category value, invoice number related to the product purchased with credit, ownership information, vehicle ownership information, stock information, manufacturer warranty period, insurance product code, order number, order date.)

Marketing information (cookie records, survey answers)

Criminal convictions and security measures (criminal record)

Biometric data (biometric photo, biometric permit)

Health information (health report, information on disability status, health data [current disease, past disease, treatments and other information], medication information)

2. REASONS OF LEGALITY

• Explicitly prescribed by law (Article 5/2(a))

Customer acquisition; customer acquisition [capturing ID image via Optical Character Recognition (‘’OCR’’)]; customer acquisition [scanning ID chip and capturing ID image via NFC]; customer acquisition under corporate Mobile Banking/Real Person Commercial Enterprise (GKTİ) video banking; managing customer information related to statute of limitations for deposit accounts; fulfilling obligations under FATCA; the tax residency determination process for individual customers of financial institutions; communication, consent, and reporting processes; implementing account hold processes; responding to information requests from official institutions and authorities; sending notices to debtors, evaluating loan requests received through the Interface Provider Getir Teknolojik Hizmetler A.Ş. (‘’GetirFinans’’); assessing personal loan applications; evaluating loan requests received from the Bank's Internal Digital platforms; conducting individual KKB inquiries to assess loan requests received from the Bank's Internal Digital platforms; evaluating shopping loan applications; monitoring risks related to the outcomes of interbank restructuring processes; ensuring information security in File Transfer Protocol usage processes; matching customers with packages in the extra earning process, managing risk processes as part of the Early Warning System; monitoring risks related to the outcomes of Figo Financing Credit processes; managing CRS processes; conducting individual KKB inquiries to evaluate loan requests received from GetirFinans platforms; managing password retrieval and forgotten password processes via video banking; updating phone numbers via video banking; communication, consent, and reporting processes as part of Turkish citizenship procedures; conducting customer inquiries through the Land Registry and Cadastre Information System (“TAKBİS”), conducting KKB inquiries to monitor risks related to the outcomes of loans; conducting Promissory Note-Check Concentration Observation to monitor risks related to the outcomes of loans; monitoring other bank checks to track risks related to the outcomes of loans; conducting Early Warning System (EWS) observation to monitor risks related to the outcomes of loans; monitoring delinquent loans to track risks related to the outcomes of loans; conducting bankruptcy concordat observation to monitor risks related to the outcomes of loans; conducting limit-risk observation to track risks related to the outcomes of loans; conducting cash loan observation to monitor risks related to the outcomes of loans; monitoring checks at the bank queried through clearing to track risks related to the outcomes of loans; conducting collateral observation to monitor risks related to the outcomes of loans; conducting legal proceedings observation to track risks related to the outcomes of loans; conducting check index inquiry to monitor risks related to the outcomes of loans; conducting TAKBİS inquiry to monitor risks related to the outcomes of loans; managing the process of creating and updating the Fiba Key via video banking; managing the customer acquisition process via video banking; conducting individual KKB inquiries to evaluate loan requests from store platforms; reviewing KKB records to manage processes related to monitoring loan payments; reviewing TAKBİS records to manage processes related to monitoring loan payments; managing processes related to monitoring loan payments - Appraisal report; conducting KKB inquiries via the Application Observation Screen to evaluate loan applications from existing customers; Conducting inquiries regarding the loans used in the last 24 hours to evaluate loan applications from existing customers; conducting check-promissory note inquiries to evaluate loan applications from existing customers; intelligence/combined inquiry; performing risk assessments for individuals to whom store credit will be marketed; evaluating loan requests received from store platforms; conducting application observations to evaluate loan applications from existing customers - Intelligence; reviewing the Individual Loan Request Form to evaluate loan requests from branches; conducting individual KKB inquiries to evaluate loan requests from branches; conducting corporate KKB inquiries to evaluate loan applications from existing customers; conducting TAKBİS inquiries to analyze financial data for evaluating/assessing the creditworthiness of existing customers; measuring, assessing and reporting on key climate-related credit risks to contribute to environmental sustainability; individual customer process management; collecting identity documents to evaluate loan requests from branches; reviewing income documents to evaluate loan requests from branches; reviewing the Individual Loan Request Form to evaluate loan requests from branches; conducting risk assessments for individuals to whom Tarfin credit will be marketed; conducting risk assessments for individuals to whom agricultural credit will be marketed; credit evaluation processes for applications conducted via the FHY step; credit evaluation processes for applications conducted via Batch List Upload in Agricultural Automation; credit evaluation processes for applications conducted through the Manual Agricultural TBG flow; credit evaluation processes for the Maturity Revision Batch application in Agricultural Automation; tracking the performance evaluation of customer representatives across all units; reviewing the Individual Loan Request Form to evaluate loan requests under the in-store credit system; updating credit card limits; ensuring information security in FTP usage processes; reporting information accessed during the check tracking process to senior management; monitoring customer account transactions; intelligence/combined inquiry; evaluating loan applications – risk center; evaluating loan applications – Central Decision Support System ("MKDS"); Conducting MKDS inquiries to monitor deteriorations in the credit performance of existing customers; conducting RA inquiries to identify customers for credit allocation; conducting KKB inquiries to identify customers eligible for credit allocation; providing account statements to customers; receiving credit card/bank card requests; maintaining log records of emails; managing the SIM card unblocking process as part of Video Banking; scanning the ID chip via NFC during the SIM card unblocking process; scanning the ID chip via NFC during the phone number update process; monitoring purchases and sales within the bank; conducting account investigations related to tax audits; obtaining information related to the holders of credit cards belonging to customer firms; handling incoming calls from customers; corporate customer process management; taking action on lien letters; branch internal audit reporting; reporting daily transactions to the Central Bank of the Republic of Turkey (“CBRT”); the foreign currency transfer process for amounts equivalent to USD 50,000 and above; providing customer access to the Web Service Protocol; receiving credit applications via SMS through the Bank’s contracted business partners and service providers; Conducting RA checks upon receiving credit applications; performing corporate KKB inquiries to evaluate customer credit applications; performing individual KKB inquiries to evaluate customer credit applications; conducting identity verification for customers to whom products will be assigned; conducting individual KKB inquiries for customer credit line assessment; conducting corporate KKB inquiries for customer credit line assessment; conducting RA inquiries for customer credit line assessment; conducting check index inquiries for customer credit line assessment; monitoring deteriorations in the credit performance of existing customers via the Core Banking Early Warning Observation Screen; conducting MKDS inquiries to track deteriorations in the credit performance of existing customers; conducting KKB inquiries to track deteriorations in the credit performance of existing customers; observing combined records to track deteriorations in the credit performance of existing customers; conducting individual KKB inquiries to track deteriorations in the credit performance of existing customers; conducting POS inquiries for customer credit line assessment; performing corporate KKB inquiries to evaluate eligibility for commercial credit; performing individual KKB inquiries to evaluate eligibility for commercial credit; conducting KRM inquiries for customer credit line assessment; conducting TKN inquiries for customer credit line assessment; providing internet access to visitors at office buildings; managing the guest internet access system; evaluating loan requests from online integration platforms; conducting individual KKB inquiries to evaluate loan requests from online integration platforms; performing corporate KKB inquiries to evaluate credit applications from potential customers; conducting corporate KKB inquiries to evaluate checks to be taken as collateral; conducting individual KKB inquiries to evaluate checks to be taken as collateral; reviewing check reports to evaluate checks to be taken as collateral; conducting TAKBİS inquiries on customers' real estate in case of delays or issues with loan payments; reviewing Company Introduction Reports (“FTR”) received from branches; obtaining a consent form from the real estate owner for the Land Registry and Cadastre Sharing System (“TAKPAS”); establishing a pledge right through the Movable Pledge Registry for Commercial Transactions (“TARES”); operating a secure payment system for transferring the sale amount of a vehicle sold by a notary to the sellinger's account; Managing chargeback & dispute processes; keeping log records of erroneous entries; tracking which user triggered SMS and OTPs; conducting KKB inquiries to analyze financial data for credit evaluation/creditworthiness of existing customers; conducting TAKBİS inquiries to analyze financial data for credit evaluation/creditworthiness of existing customers; reviewing financial analysis reports to analyze financial data for credit evaluation/creditworthiness of existing customers; evaluating customer complaints; assessing customer requests and complaints via live chat (Fi'bot); verifying the customer during conversations; conducting KKB checks to assess the risk of customers to whom credit will be marketed; determining the credit portfolio to be transferred to the fund to be established by our bank for the issuance of asset-backed securities; conducting analytical studies for the securitization of loans to be transferred to the fund.

• The processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of a contract (Article 5/2 (c))

Opening accounts through the branch channel; managing processes related to donation payments; performing update transactions for individual customers; performing updates based on VKN data in line with information changes; performing update transactions for changing information; evaluating applications for state-supported credit insurance; managing processes related to EFT/FAST (Fast and Secure Transfers) transactions; managing the customer acquisition process via mobile/video banking; managing the firm introduction report processes; executing fund purchase transactions; managing the process of delivering the GetirFinans account card product to the customer and completing missing documents; managing the process of delivering the GetirFinans credit card product to the customer and completing missing documents; opening stock market accounts; automatically recording account movements into the Customer's accounting system; managing electronic statement processes; managing the processes related to the physical printing of card statements; managing the processes related to card statement delivery; managing the card printing process; managing requests for storing bank and credit card information in the Masterpass infrastructure; managing credit notification processes; opening accounts through digital channels; receiving applications for banking products via the official website; collecting card information during the POS process; storing data related to prospective customers whose acquisition process could not be completed; customer acquisition (capturing ID image via OCR); customer acquisition (reading ID chip and capturing ID image via NFC); customer acquisition (reading ID chip and capturing ID image via NFC); customer acquisition under corporate Mobile Banking/Real Person Commercial Enterprise (GKTİ) video banking; processing transactions related to checks/promissory notes taken as collateral or for collection; providing promotions for customer pension payments; managing processes related to money transfer transactions; managing processes related to EFT/Fast and Secure Transfers (FAST); banking transactions for foreign nationals; reviewing the necessary document for defining Fiba Key; managing the process of creating and updating Fiba Key via video banking; determining the Fiba Key; acquiring customers and marketing products in FİGO processes; managing password retrieval and forgotten password processes via video banking; updating phone numbers via video banking; managing customer personal information; conducting/managing contract processes; responding to information requests from bank branches; addressing requests related to reference letters; receiving application requests regarding investment services and activities at Fiba Yatırım Menkul Değerler A.Ş. (“Fiba Yatırım”), providing investment services and activities and establishing customer relations, carrying out operational processes and evaluating your request; carrying out transactions regarding stocks/capital market instruments; managing/executing business processes regarding monitoring investment fund processes of the customer; collecting payments from customers entering the legal follow-up process; assigning receivables in enforcement cases and managing the process; facilitating bill payments on behalf of customers; opening individual accounts on behalf of corporate customers; setting up the necessary configurations for FTP usage; facilitating batch EFT/SWIFT transactions for customers via FTP; providing FTP access to customers; setting up the necessary configurations for the use of the Web Service Protocol; providing customer access to the Web Service Protocol; setting up the necessary configurations for the use of the Account Statement Web Service Application; opening accounts through the store channel; receiving store credit applications via SMS; enabling customers to monitor account transactions; facilitating dealer invoice payments on behalf of the main company to ensure cash flow; providing financing to customers based on the future receivables of their suppliers; signing a protocol related to the electronic statement process; querying and displaying credit line information in the application of service providers, primarily DSM Turkey Teknoloji Hizmetleri A.Ş. ("Trendyol"); granting Tarfin credit; receiving Tarfin credit applications via SMS; storing data related to potential customers whose acquisition process could not be completed; automatically recording account movements into the customer’s accounting system; displaying account information held at other account service providers (“HHS”) within the Bank’s mobile banking and offering account services; initiating payment orders on payment accounts held at other payment service providers (“ÖHS”) without providing access to the ÖHS; displaying account information held at the Bank on other HHS online platforms and offering account services, initiating payment orders through other ÖHS online platforms without providing access to the Bank; sending Printed Express Cards; informing customers about campaign results; providing physical POS field services to customers; offering Virtual POS services to customers; managing processes related to POS statement delivery; Marketing the POS products of Ödeal Ödeme Kuruluşu A.Ş. (“Ödeal”) and forwarding applications related to these products to Ödeal informing customers about changes in interest rates; collecting card information during the virtual POS process; accessing customer data during transaction-related conversations; recording conversations related to transactions; credit evaluation processes for applications conducted via the FHY step; credit evaluation processes for applications made via SMS; conducting land registry inquiries for credit line assessment; conducting product inquiries for credit line assessment; providing approval for deposit products; calling customers daily as part of customer transactions; approving customer expenses; conducting evaluations for assigning limits to customers; performing analyses for the pricing process; taking action on customer complaints; account opening; executing stock transactions; handling requests related to reference letters; executing foreign exchange and precious metal trading transactions; collecting customer information for Kiraz account applications; collecting customer information for Kiraz Plus account applications; receiving applications for products via the official website; executing cryptocurrency transfers; receiving applications for time deposit accounts; processing tax identification numbers for foreign customers; corporate customer process management; receiving applications for demand deposit accounts; providing vehicle insurance quotes; offering promotions for customer pension payments; providing Private Pension System (BES) quotes; providing quotes for other elementary insurance (DASK, home, fire, etc.); matching information during the policy issuance process; evaluating life insurance applications; fulfilling requests for ancillary financial products related to consumer credit by providing product insurance; receiving applications for products via the official website; updating contact information; collecting necessary information for customer system checks; conducting RA inquiries to locate customers' addresses; entering passwords for self-service updates; entering passwords on the SIM card unblock screen; scanning the ID chip via NFC during the SIM card unblock process; scanning the ID chip via NFC during the phone number update process; issuing compulsory earthquake insurance policies; issuing health insurance policies; concluding Private Pension System (BES) agreements; issuing comprehensive insurance policies (kasko); issuing policies; evaluating life insurance applications; issuing special workplace package insurance policies; issuing credit housing insurance policies; issuing credit life insurance policies; issuing credit life insurance (involuntary unemployment coverage) policies; matching policy information with data in the database; creating a list of policies to be renewed; managing card requests; managing processes related to card delivery; managing customer POS requests; managing cash register POS requests; tracking customer investment fund processes; tracking customer bond processes; providing functions for messages required for derivative transactions; tracking customer observation screens; executing transactions related to foreign trade products; managing SWIFT message processes; handling money transfer transactions via the Document Management System (“DYS”); managing the customer’s credit payment process; responding to information requests from branches; receiving store credit applications via SMS; conducting customer inquiries during the credit application process; managing merchant requests; receiving credit applications via SMS through the Bank’s contracted business partners and service providers,and verifying customer information for loan disbursement; receiving credit applications; tracking applications made through non-branch channels; tracking the credit processes of customers using agricultural cards; obtaining information for those applying for agricultural card life insurance; managing credit evaluation processes for the maturity revision batch application in agricultural automation; receiving customer instructions for agricultural card statement delivery; creating credit offers; receiving agricultural credit applications via SMS; fulfilling pre-contractual information obligations; managing KMH (Overdraft Deposit Account) / Hızlı Para products; concluding KMH / Hızlı Para agreements; receiving instructions for KMH/ Hızlı Para definition; receiving KMH / Hızlı Para instructions related to the repayment of loan installments; managing KMH / Hızlı Para limit increase processes; receiving instructions for KMH / Hızlı Para information updates; receiving instructions related to agricultural card loans; signing a declaration for insurance requests; granting individual loans; concluding housing finance loan agreements; concluding consumer loan agreements; concluding vehicle pledge agreements; concluding treasury bill/government bond pledge agreements; concluding derivative products foreign currency-denominated bonds (Eurobond) pledge agreements; concluding gold pledge agreements; concluding receivables transfer agreements; concluding agreements for the transfer of POS receivables; concluding framework agreements for derivative transactions; concluding bank bond pledge agreements; concluding securities and deposit pledge agreements; signing protocols for interest/maturity changes; creating payment plans in accordance with loan agreements; managing requests related to letters of guarantee; signing a general guarantee declaration for early repayment; managing the process of document delivery within the branch; concluding company credit card membership agreements; granting variable interest rate loans; Registering collateral in the system; issuing an Authorization Certificate under the Direct Debit System (“DBS”); sending checks to the Credit Allocation unit for limit allocation; collecting necessary information for debt restructuring if the customer is unable to repay their debt; conducting automatic calls for receivables follow-up; contacting customers for debt collection purposes; performing transactions with credit/bank cards at ATMs and POS devices belonging to different banks.

• It is mandatory for the data controller to fulfill its legal obligation (Article 5/2 (ç))

Managing customer information related to statute of limitations for deposit accounts; fulfilling obligations under FATCA; tax residency determination process for individual customers of financial institutions; fulfilling the obligation to report safe deposit boxes; communication, consent, and reporting processes; implementing account hold processes; managing CRS processes; tax residency determination process for individual customers of financial institutions; contacting customers via Bloomberg chat (IB chat); managing the pricing process for customers and branches via Bloomberg; managing the pricing process for customers and branches via Reuters Messenger; generating PowerBI reports; responding to information requests from official institutions and authorities; handling tax office inquiries related to enforcement files; fulfilling independent audit requests; conducting central/periodic checks as part of banking processes; preparing independent audit reports; tracking legal proceedings; reporting legal proceedings to accounting; conducting continuous audit activities within banking processes; conducting branch audits within banking processes; identification during account opening for the provision of investment services and activities; mediation in the transmission of orders for capital market instruments; providing information to relevant units in response to information requests from official institutions and authorities; assessing customer requests and complaints via live chat (Fi'bot); tracking the performance evaluation of customer representatives across all units; providing information on customer complaints submitted through authorized institutions; monitoring staff-related money transfer controls between customers or other personnel; managing processes for outgoing funds from customer accounts where the recipient is a bank employee; assessing cases where the same phone number is assigned to both an employee and a customer; monitoring betting transactions; conducting checks on suspicious transactions related to individuals acting as proxies for multiple customers; monitoring transactions from elderly customers' accounts; managing processes to ensure information security and prevent data leakage; monitoring customers who share the same phone number; monitoring back-valued term accounts; monitoring debit transactions from joint accounts; reviewing commission refunds; monitoring debit transactions for non-resident customers processed through branches; monitoring debit transactions for customers who have been reactivated from dormant status; checking derivative transactions' standard risk coefficient potential values; reporting errors encountered by developers; making regulatory notifications to holding subsidiaries with financial group status; monitoring credit customers without group definition; checking transactions conducted at multiple branches for the same customer on the same day; managing interest rate risk and liquidity processes; monitoring individual loans transferred to follow-up without any collection; checking customers with overdue credit line revision dates; monitoring KMH / Hızlı Para limit breaches; reviewing customers with changing loan interest rates; monitoring customers credited with points on their credit cards; reviewing POS commission rates; checking duplicate CIF entries; ensuring compliance with legal limits for EFTtransfer commissions; listening to inappropriate calls; monitoring and blocking call traffic to prevent cases of telephone fraud; monitoring devices with mobile applications installed to detect malware and informing customers; monitoring personal customer accounts with frequent cash inflows; evaluating credit applications and credit lines; handling various receivable (MA) transactions settled through loan disbursements; monitoring credit card payments made from an account belonging to someone other than the cardholder; checking cash withdrawal and deposit transactions with a one-day difference; reviewing credit payments made with funds transferred from different customers; verifying the accuracy of credit allocation fees collected from financial consumers; monitoring customers who were granted individual loans through channels other than the branch despite having a proxy/guardian; tracking customers who simultaneously profit from foreign exchange transactions; monitoring the purchase of foreign currency using loan disbursement funds; monitoring the purchase of cryptocurrency using loan disbursement funds; reporting to the Banking Regulation and Supervision Agency (“BRSA”); conducting BRSA management statement tests; managing Information Security Awareness Activities processes; monitoring emails and internet traffic sent by users through DLP (Data Loss Prevention); keeping log records related to rejected loan applications; restoring deleted data; carrying out efforts to prevent fraud-related losses for the bank and its customers; managing fraud prevention processes; ensuring information security in FTP usage processes; reporting accessed information during check tracking processes to senior management; monitoring customer account transactions; managing the process of creating records for the trial balance; reporting transactions that fit the suspicious transaction scenario to the Financial Crimes Investigation Board (“MASAK”); taking necessary actions to correct reverse entries; submitting the bank’s legal records to the Revenue Administration; Assets and Liabilities Committee (‘’ALCO’’) reporting; APKO reporting; Oracle Business Intelligence (“OBI”) reports; non-cash loans reporting; processing customers' tax payments; conducting necessary investigations to respond to requests from official institutions; reporting to official institutions; reporting annual transaction activities as part of customer relations; credit reporting; reporting on restructured loans; responding to regulatory questions from business units; conducting efforts to prevent fraud-related losses for 1st and 2nd degree customers; managing the process of detecting credit applications made using falsified documents; identifying prohibited individuals through categorization; determining the compliance of customer transactions with suspicious transaction scenarios; reporting to the Audit Committee; preparing finding reports and tracking actions related to findings; managing the process of evaluating whistleblower forms; evaluating AML notifications; reporting daily temporary commercial loan repayments; reporting daily temporary commercial loan information; managing communication, approval, and reporting processes related to Turkish citizenship transactions; reporting on derivative financial instruments; managing the automation of ALCO reports; managing the automation of derivative financial instruments reporting; managing the automation of credit reporting; monitoring customer transactions to prevent external fraud losses for customers; collecting customer information for the issuance of security keys; determining the Fiba key for customers; providing opinions to the customer allocation unit; ensuring information security in the File Transfer Protocol usage processes; taking necessary actions to correct reverse entries; monitoring card information to prevent customers from suffering losses due to external fraud by tracking customer transactions; weekly reporting on fraud-affected customers and related losses; conducting fraud detection controls to prevent potential customer losses; preparing annual reports on transfer pricing; managing the transaction monitoring process; contacting customers to verify their identity; managing the process of approving the acquisition of customers who meet the criteria within the customer identification process; conducting necessary investigations and reporting to official institutions to respond to requests from official bodies; contacting correspondent banks regarding customer transactions; entering expense data; monitoring credit projects through the Corporate Loans-Cash Loans-Credit Monitoring screens; monitoring credit projects through the Limit-Risk-Customer and Group-Based Risk screens; reviewing combined report screens for the monitoring and tracking of credit projects; reviewing Project Evaluation Presentations for monitoring and tracking credit projects; reviewing collateral monitoring screens for credit project tracking; managing interest rate risk and liquidity risk processes; BRSA reporting; customer scoring, classification, and rating processes; ALCO reporting; International Financial Reporting Standards (‘’IFRS’’) reporting;; resolving complaints related to Automatic Teller Machines (‘’ATM’s’’); resolving complaints related to shared ATMs; branch internal audit reporting; taking action on lien notices; responding to information requests from official institutions; account investigations related to tax audits; providing information to authorized institutions regarding newly opened investment accounts; providing information to authorized institutions regarding gold transfers; monitoring buying/selling transactions held at the bank; manually processing receipts; managing the customs declaration process; responding to information requests from official institutions; reporting daily transactions to the Central Bank of Turkey (‘’CBRT’’); handling foreign currency transfers equivalent to USD 50,000 or more; verifying the identity of customers for product setup; obtaining information related to foreign tax residency; collecting customer information for the issuance of security keys; conducting physical settlements as part of branch audits; performing process audits within banking procedures; conducting investigations and inquiries within banking processes; reviewing customer accounts in case of complaints from customers; preparing finding reports; MASAK (Financial Crimes Investigation Board) reporting; reporting errors encountered in customer-facing applications; performing KKB inquiries for Credit Guarantee Fund (‘’CGF’’) credit performance reporting; reporting credit performance to the CKGF; fulfilling pre-contractual information obligations; independent audit reporting; evaluating customer complaints; assessing requests and complaints via the call center channel; handling customer calls; analyzing voice recordings for quality levels and reporting to the BRSA; verifying customers or prospective customers during calls; validating customer or prospective customer information during calls; recording call center conversations with customers or prospective customers; managing accounting processes; managing clearing processes; transmitting incorrect voice recordings to customers; verifying customers via phone; customer scoring, classification, and rating processes.

• It has been publicly disclosed by the data subject themselves (Article 5/2(d))

Complaint and reputation management.

• The processing of data is mandatory for the establishment, exercise, or protection of a legal right (Article 5/2(e))

Sending notices to debtors; transferring receivables from enforcement files and managing the process; tracking and conducting enforcement actions; creating status reports as part of enforcement process monitoring; managing litigation/enforcement processes; transferring receivables to asset fund companies; monitoring enforcement processes; initiating enforcement proceedings against debtors through İcratek; responding to requests from judicial authorities; initiating enforcement proceedings against debtors through UYAP; outsourcing services for enforcement follow-up; making expense payments for departmental expenditures; managing the guarantee process; managing processes necessary to monitor delinquent bank employees; managing litigation processes; obtaining letters of guarantee from other banks in stay of execution processes; monitoring and managing mediation processes; tracking delinquent customers; implementing processes to contact delinquent and unreachable customers; performing Individual KKB inquiries to track delinquent customers; performing Corporate KKB inquiries to track delinquent customers; managing concordat processes; directing the follow-up and collection process for monitored customers to the relevant business unit or attorney; making expense payments for cases completed by the legal department; presenting the list of repurchase properties to the relevant business units; executing pre-sale and sale transactions for properties acquired by the bank in settlement of receivables through the conclusion of repurchase agreements; submitting the appraisal report to intermediary institutions for properties acquired by the bank in settlement of receivables for pre-sale and sale transactions; preparing and reviewing appraisal reports for properties to be taken as collateral; reporting properties to be sold to the relevant business unit; creating a list of debtors to be contacted.

• The processing of data is mandatory for the legitimate interests of the data controller (Article 5/2(f))

Periodic reporting based on profit; reporting delinquent customers to the relevant business units; tracking customer status and monitoring calls; managing processes to offer and maintain the Mobile Application for customers; sharing necessary information with relevant business units to carry out enforcement follow-up processes; reporting to senior management to ensure the accuracy of information in reports prepared for the BRSA; verifying customer data for customer authentication; reporting routine checks conducted to detect errors in data or accounting; preparing reports for the Board of Directors; monthly reporting to the Board of Directors; managing processes to provide and maintain Internet Banking services for customers; monitoring, organizing, and assessing the profitability of derivative transactions; generating end-of-day reports for options and swaps; tracking customer profitability; monitoring deposit returns; managing customer campaign processes; reporting customer transaction statements; tracking customer status through Power BI reporting management; reporting customer transaction statements; contacting individuals who initiated but did not complete the customer onboarding process to finalize their customer registration via video banking; managing password transactions through video banking; updating phone numbers through video banking; monitoring customer profitability; tracking employee performance; reporting to senior management; performing statistical analysis of transactions conducted on digital channels; enhancing customer experience across digital channels and bank platforms; managing complaints and reputation; tracking calls; monthly reporting to the Board of Directors; preparing executive summaries related to Company Introduction Reports and presenting them to the Assistant General Manager; registering collateral in the system; conducting customer segmentation to develop marketing strategies; identifying target customer groups to offer real-time campaigns; managing individual customer processes; tracking customer complaints; evaluating the performance of customer representatives; identifying the target customer audience for marketing communications; the process of creating customer segments to enhance marketing activities; reinforcing segmentation data; tracking applications submitted through non-branch channels; conducting fraud checks in loan disbursements; issuing voluntary carbon reduction certificates to customers using credit in order to offset the carbon emissions resulting from the production of the product they purchased by loan; determining the credit portfolio for the issuance of asset-backed securities and the portfolio will be transferred to a fund established by our bank; conducting analytical studies for the securitization of loans to be transferred to the fund.

• Explicit consent (Article 5/1)

Customer acquisition for prospective clients through video banking processes; contacting customers for marketing/promotion purposes within open banking processes; maintaining lists of companies to be called; conducting KKB inquiries via the Application Monitoring Screen for evaluating prospective clients' loan applications; enhancing customer experience on digital channels; performing statistical analysis of transactions carried out through digital channels; creation/updating of Fiba Key as part of video banking; identification of the target customer base for communication purposes; analysis to ensure the provision of advantageous interest rates for specific customers; sending gifts to customers on special occasions; contacting customers who call the call center for marketing purposes; communicating with customers who call the call center for marketing purposes via an interactive voice response system; maintaining lists of companies to be visited; reinforcement of segmentation information; management of telemarketing processes; querying information about credits used in the last 24 hours for evaluating credit applications of prospective customers; conducting check and promissory note inquiries for evaluating prospective customers' credit applications; performing application observations for intelligence purposes to assess prospective customers' credit applications; evaluating prospective customers' credit applications; conducting KKB (Kredi Kayıt Bürosu) inquiries to analyze financial data for credit assessment/creditworthiness of prospective customers; conducting TAKBİS (Central Registration System) inquiries to analyze financial data for credit assessment/creditworthiness of prospective customers; reviewing financial analysis reports to assess the financial data of prospective customers for credit evaluation/creditworthiness; conducting corporate KKB inquiries for evaluating prospective customers' credit applications; conducting individual KKB (Kredi Kayıt Bürosu) inquiries for evaluating prospective customers' credit applications; performing KKB checks to assess the risk of prospective customers for credit marketing purposes; conducting KKB inquiries to identify prospective customers who can be allocated credit; conducting RA (Revenue Administration) inquiries to identify prospective customers who can be allocated credit; performing credit line evaluations for prospective customers; conducting RA inquiries for credit line evaluations; managing reporting processes; conducting check index inquiries for credit line evaluations of prospective customers; sending SMS/e-mails and making calls for marketing activities, including individual and/or commercial credit marketing purposes, regardless of the customer segment to which prospective customers apply; conducting marketing activities with customers through internet banking, including individual and/or commercial credit marketing purposes; contacting customers for product promotion; communicating with authorities regarding the marketing of loans; sending commercial electronic messages about insurance products; sharing guest information and making reservations with the team organizing the outdoor cinema event at the hotel; performing statistical analysis; offering special privileges and sending gifts to customers as part of loyalty program activities; sending certificates to customers who make donations from the organization they donated to; using facial recognition systems for SIM card unblocking; using facial recognition systems for phone number updates; collecting customer feedback; sending commercial electronic messages and obtaining consent for commercial electronic communications; managing NPS surveys; maintaining central sales lists; sending SMS/e-mails to customers for marketing activities, including individual and/or commercial credit marketing purposes, regardless of the customer segment; conducting marketing activities by group insurance companies to present insurance offers to customers; sending promotional messages (push notifications) and making calls via Mobile Banking; offering promotions, offers, and promotions through digital channels, including push notifications from Mobile Banking; using cookies; marketing based on product trend preferences; contacting customers for customer satisfaction, profiling, and in-depth analysis purposes; calling customers for information/marketing purposes; customizing the offered products and services according to preferences, usage habits, and needs; transferring commission amounts to customers’ Fibabanka accounts that Trendyol will deposit based on credit provision through the support service organization Trendyol; updating account information with Trendyol in case of early repayment or end-of-term settlement of the loan used from Trendyol.

• Explicit consent (Article 6/3(a))

Evaluating life insurance applications; acquiring customers through Corporate Mobile Banking/GKTİ video banking; arranging insurance policies; responding to information requests from bank branches; obtaining information for individuals applying for agricultural card life insurance; processing biometric data in the processes conducted through Corporate Mobile Banking/GKTİ video banking; working on credit modeling specific to customers, calculating credit risk, providing product insurance based on requests related to products purchased with credit, checking with RA to verify whether customers have individual commercial enterprises, and conducting marketing to open accounts for customers' individual commercial enterprises.

3. SHARING YOUR PERSONAL DATA WITH THIRD PARTIES

Your personal data mentioned above is transferred to the domestic and/or overseas recipient groups listed below in accordance with the purposes and legal grounds specified below.

Pursuant to Article 9/10 of the LPPD, the particulars regarding the data transfer that is considered a customer secret in accordance with the regulations in the banking legislation are reserved. In this context, in cases where data transfer is required in accordance with the banking legislation, you will be contacted separately and detailed notification will be provided on the matter.

• Due to the legal ground explicitly prescribed by laws (Article 5/2(a)),

To the Authorized Public Institutions and Organizations for the purpose of (including the Identity Sharing System, Address Sharing System, Revenue Administration, MERSIS, MASAK, Banking Regulation and Supervision Agency (‘’BRSA’’), Craftsmen and Tradesmen Information System (“ESBİS”), Credit Registry, NRIS (enforcement information), UYAP, Central Registry Agency (“MKK”), Communication Management System (‘’İYS’’), General Directorate of Land Registry and Cadastre, TAKBİS, Ministry of Treasury and Finance, Turkish Notaries Union, Savings Deposit Insurance Fund (“TMSF”), Presidency Communication Center (“CİMER”), Turkish Banks Association (“TBB”), Ministries, KVK Board, Law Enforcement Agencies, Prosecutor's Office, Courts, Central Bank of the Republic of Turkey (‘’CBRT’’), Enforcement Offices, Municipalities and the Post and Telegraph Organization (“PTT”)), acquiring customers through Corporate Mobile Banking/GKTİ video banking; managing processes for obtaining consent; managing processes related to establishing lien rights; managing information related to customers; determining the tax residency of individual clients by financial institutions; fulfilling obligations under FATCA; performing block operations on accounts; responding to information requests from official institutions and organizations; managing communication, consent, and reporting processes; ensuring information security in FTP usage processes; providing access to the customer's Web Service Protocol; ensuring information security in file transfer protocol usage processes; responding to requests from official institutions; sending notices to debtors; transferring the sale price of a vehicle sold by a notary to the sellinger's account; obtaining information on credit card holders for customer firms; conducting TAKBİS (Central Registration System) inquiries to analyze the financial data of existing customers for credit assessment/creditworthiness; managing communication, consent, and reporting processes related to Turkish citizenship procedures; determining the credit portfolio for the issuance of asset-backed securities and the portfolio will be transferred to a fund established by our bank; conducting analytical studies for the securitization of loans to be transferred to the fund,

To the Suppliers for the purpose of conducting Credit Registry Inquiries for Application Observation Screen for evaluating existing customers' loan applications; performing Application Observations for evaluating the loan applications of existing customers; conducting Application Observations – Intelligence; evaluating existing customers' loan applications; performing Check-Draft Inquiries for evaluating the loan applications of existing customers; querying information on credits used in the last 24 hours for evaluating the loan applications of existing customers; evaluating the loan applications of existing customers; conducting Corporate Credit Registry inquiries for assessing the loan applications of potential customers; assessing customer complaints; handling incoming calls from customers; verifying customers during conversations; reviewing financial analysis reports for analyzing the financial data of existing customers for credit evaluation/creditworthiness; conducting Credit Registry inquiries for analyzing the financial data of existing customers for credit evaluation/creditworthiness; obtaining information on credit card holders for customer firms,

To the Business Partners for the purpose of performing Individual Credit Registry Inquiries for evaluating loan requests received from online integration platforms; assessing shopping credit applications; evaluating personal loan applications; managing links processes; performing Individual Credit Registry Inquiries for evaluating loan requests received from online integration platforms; managing shopping loan processes; performing Individual Credit Registry Inquiries for evaluating loan requests received from store-based platforms,

To the other Banks for the purpose of performing transactions with credit/debit cards at ATMs and POS terminals of different banks,

• Due to the legal basis of necessity for processing personal data of the parties to a contract, as it is directly related to the establishment or performance of the contract (Article 5/2(c)),

To the Other Recipient Groups (donation recipient institutions, relevant organizations/individuals, firms requesting the sharing of account information, firms in a commercial relationship, legal representatives/law firms providing services) for the purpose of managing donation payment processes; responding to requests for reference letters; managing requests related to guarantee letters; ensuring monitoring of account transactions by the customer; managing DBS processes; collecting from customers entering the legal collection process,

To the Private Legal Entities (Banks, Kredi Garanti Fonu A.Ş., Türkiye Varlık Fonu Yönetimi A.Ş) for the purpose of processing of collateral or collected checks/promissory notes; managing EFT/FAST transactions; collecting from customers entering the legal collection process; assignment of receivables from enforcement files and process management, responding to the inquiries of the counterparty bank; handling customer’s personnel details, handling CRS processes; SWIFT message processes; conducting international money transfer transactions; performing transactions related to foreign trade products,

To the Authorized Public institutions and Organizations (Social Security Institution (SGK), Central Bank of the Republic of Turkey (CBRT), Identity Sharing System, TAKBİS, Address Sharing System, Revenue Administration, MERSİS, ESBİS, Kredi Kayıt Bürosu (KKB), Central Registry Agency (MKK), Settlement and Custody Bank (Takasbank), Istanbul Stock Exchange (Borsa İstanbul)), for the purpose of performing customer acquisition (obtaining ID images via OCR), Customer acquisition (scanning ID chips via NFC and obtaining ID images); managing and updating the Fiba Key in video banking, Storing data for prospective customers whose acquisition process could not be completed; providing promotions for customer retirement salaries; managing processes related to money transfers; managing processes related to EFT/FAST transactions; receiving loan applications; processing store loan applications via SMS; receiving loan applications via SMS through the Bank's affiliated partners and support service providers; receiving Tarfin credit applications via SMS; conducting customer acquisition under Corporate Mobile Banking/GKTİ video banking; managing the SIM card unblocking process in video banking; managing the phone number update process in video banking; scanning the identity chip with NFC during the SIM card unblocking process; scanning the identity chip with NFC during the phone number update process; managing the business processes related to tracking bond processes for customers; managing the business processes related to tracking investment fund processes for customers; performing TAKBİS queries for analyzing the financial data of potential customers for credit evaluation/creditworthiness,

To the Group (Insurance) Companies for the purpose of presenting BES (Personal Pension System) offers; evaluating applications for state-supported receivables insurance; evaluating life insurance applications; matching information during the policy issuance process; issuing insurance policies; obtaining information from those applying for agricultural card life insurance; creating a list of policies to be renewed; issuing auto insurance (comprehensive insurance) policies; issuing credit life insurance policies (involuntary unemployment coverage); issuing credit life insurance policies; matching policy information with the data in the database; issuing health insurance policies; managing insurance requests; managing operational processes related to insurance contracts and policies; fulfilling internal systems, risk monitoring, and notification obligations, along with meeting the requirements of insurance contracts; and managing demands and complaints,

To the Insurance Companies and Assistance Service Providers for the purpose of issuing insurance policies; issuing auto insurance (comprehensive insurance) policies; issuing compulsory earthquake insurance policies; issuing special workplace package insurance policies; issuing credit-related home insurance policies; matching policy information with the data in the database; creating a list of policies to be renewed; presenting vehicle insurance offers; evaluating applications for statesupported receivables insurance; presenting other elementary insurance offers (compulsory earthquake insurance, home insurance, fire insurance, etc.); evaluating life insurance applications; carrying out, executing, and developing processes related to insurance products and services provided under agency status; processing personal data directly related to the establishment or performance of a contract in which the agency is a party; managing policy issuance processes; executing operational processes; complying with internal systems, risk monitoring, and notification obligations; fulfilling the requirements of the contract(s) signed with our bank,

To the Support Service Provider Companies for the purpose of (Alış Gidiş MİKS Teknoloji Danışmanlık ve Elektronik Ticaret A.Ş.,, Trendyol) querying and viewing credit line information through the applications of service providers and stores, primarily Trendyol, for use in all transactions, including compensation and recourse processes,

To the Ödeal Ödeme Kuruluşu A.Ş. for the purpose of receiving and forwarding applications for POS products offered by Ödeal,

To the Suppliers for the purpose of opening accounts through the store channel; video banking customer acquisition; performing update transactions for individual customers; setting up Internet Banking for corporate customers; sending Printed Quick Cards; providing Physical/Virtual POS services to customers; managing the delivery of POS statements; receiving credit applications; evaluating applications for state-supported receivables insurance; delivering the Getir account card product to customers and completing missing documents; evaluating life insurance applications; delivering the GetirFinans credit card product to customers and completing missing documents; managing card requests; overseeing the card delivery process; managing customer requests; managing the process of delivering card statements; managing/executing business processes related to tracking customer bond transactions; managing/executing business processes related to providing necessary functions for derivative transaction messages; managing/executing business processes related to carrying out transactions for foreign trade products; managing/executing business processes related to SWIFT messaging,

To the Business Partners for the purpose of performing account opening; execution of stock / capital market instrument transactions; video banking customer acquisition; providing vehicle insurance quotes; offering other types of non-life insurance (DASK, home, fire, etc.) quotes; issuance of various insurance policies; matching information during the policy issuance process; creating a list for policies to be renewed; conducting customer inquiries during the credit application process; verifying customer information; managing insurance requests,

To other Banks, account service providers, payment service providers for the purpose of viewing account information held at the Bank on other HHS online platforms and providing account services, executing transactions related to checks/promissory notes taken as collateral or for collection; assignment of receivables in enforcement files and process management; initiating payment orders through other ÖHS online platforms without accessing the bank,

To the Other Relevant Institutions/Individuals for responding to requests related to reference letters,

To the Companies whose other account information is requested to be shared for the purpose of following up account activities by the Customer,

To the Donation Recipient Institution for the purpose of managing Donation Payment Processes,

To Mastercard Europe SA manage customer requests for storing bank and credit card information in the Masterpass infrastructure,

To Fiba Yatırım Menkul Değerler A.Ş. for the purpose of receiving application requests regarding investment services and activities at Fiba Yatırım, providing investment services and activities and establishing customer relations, carrying out operational processes and evaluating your request; carrying out transactions regarding securities/capital market instruments; managing/executing business processes regarding monitoring investment fund processes belonging to the customer; and acting as intermediary in the transmission of orders for capital market instruments.

• Due to the legal compliance reason that processing is mandatory for the data controller to fulfill its legal obligations (Article 5/2(ç)),

To the Authorized Public Institutions and Organizations (BRSA, CİMER, TBB, Ministries, the Personal Data Protection Board, Law Enforcement, Prosecutor's Office, Court, Tax Office, TBB, Consumer Arbitration Committee, SGK, CBRT, MASAK, TBB Risk Center, BKM, Ministry of Treasury and Finance, SDIF, Enforcement Offices, Municipalities, Tax Inspection Board, Revenue Administration, MERSIS, KKB, MKK) for the purpose of weekly reporting on customers affected by fraud and related customer losses; responding to information requests from official institutions and organizations; inquiring by tax offices regarding execution files; credit applications and credit line assessments; reporting to the BRSA; ensuring information security during the use of the File Transfer Protocol; providing access to the customer’s Web Service Protocol; credit reporting; daily temporary commercial credit repayment reporting; daily temporary commercial credit information reporting; derivative financial instruments reporting; conducting preventive measures to avoid losses for the bank and its customers due to fraud; carrying out processes for preparing an investigation report on credit applications allocated through the use of false documents; Reporting to the Audit Committee; reporting transactions in line with the Suspicious Transaction Scenario to the Financial Crimes Investigation Board (MASAK); conducting necessary investigations to respond to requests from official institutions; reporting to official institutions; notifying holding subsidiaries within the financial group status in compliance with regulations; MASAK reporting; management of settlement processes; management of accounting processes; management of chargeback and dispute processes; management of dormant deposit accounts; management of customer-related information; fulfillment of obligations under FATCA; individual customer tax residency determination processes for financial institutions; CRS processes; management of customer-related information; fulfillment of safe deposit box notification obligations; communication, approval, and reporting processes for Turkish citizenship procedures; execution of account freeze operations; actions related to lien notices; account investigations related to tax audits; providing information to authorized institutions regarding opened investment accounts; tracking of purchases and sales within the Bank; customs declaration processes; reporting of daily transactions to the Central Bank of Turkey; foreign currency transfer processes for amounts equivalent to and above USD 50,000.

To Suppliers (Visa, Mastercard) for the purpose of handling clearing processes, chargeback and dispute processes,

To the Audit Companies for the purpose of following up litigation processes and reporting of independent audit,

To the Suppliers for the purpose of reporting derivative financial instruments; reporting daily temporary commercial loan repayments; reporting daily temporary commercial loan information; reporting credit; reporting restructured loan; submission of the bank’s statutory books to the Revenue Administration; preparation of independent audit reports; tracking of legal proceedings; ALCO reporting; OBI (Oracle Business Intelligence) reports; non-cash credit reporting; derivative financial instruments reporting; performing the automation processes for ALCO reporting; conducting the automation processes for credit reporting; executing the automation processes for derivative financial instruments reporting; performing continuous audit activities within banking processes; sharing transactions conducted in the market; evaluating customer complaints; handling calls received from customers; verifying the identity of customers/prospective customers during conversations; analyzing the quality of voice recordings and reporting to the BRSA; recording call center conversations with customers/prospective customers; facilitating internal communication among employees; customer verification by phone; identifying prohibited individuals through categorization; managing complaint processes; overseeing and executing the business processes related to monitoring transactions conducted within the bank; collecting customer information to provide security keys; managing clearing and settlement processes; handling accounting processes; conducting chargeback and dispute processes; reporting suspicious transactions to the Financial Crimes Investigation Board (MASAK); and implementing fraud prevention processes,

To the Contracted Banks and Institutions for the purpose of resolving the complaints relating to ATMs of another banks and to the Private Law Legal Entities (Kredi Garanti Fonu A.Ş.) for the purpose of performing credit performance reporting (CGF Reporting),

To the Business Partners for the purpose of managing the complaint processes and retaining the logs relating to rejected loans,

To Fiba Yatırım for the purpose of identification during account opening and mediating the transmission of capital market instrument orders in order to provide investment services and activities.

• On the legal basis of the data being publicly disclosed by the data subject themselves (Article 5/2(d)).

To the Suppliers for the purpose of managing the complaint and reputation processes.

• On the legal basis of the necessity of data processing for the establishment, exercise, or protection of a legal right (Article 5/2(e)),

To the Natural Persons and Private Law Legal Entities (Banks, Türkiye Varlık Fonu Yönetimi A.Ş.) for the purpose of assigning receivables in the enforcement file and management of the process; assignment of receivables to the asset management company,

To the Other Recipient Group (asset fund firms) for the purpose of assigning the receivable to the asset fund firm,

To the Authorized Public Institutions and Organizations (Union of Turkish Public Notaries, PTT) for the purpose of sending notices to the debtors,

To the Suppliers for the purpose of managing legal and enforcement processes; execution of concordat processes; execution of mediation processes; execution of guarantee processes; responding to requests from judicial authorities; tracking and execution of enforcement proceedings; tracking and execution of mediation processes; outsourcing services for enforcement proceedings; initiation of enforcement proceedings against debtors via UYAP; execution of legal proceedings; outsourcing services for legal proceedings; conducting Individual KKB inquiries to monitor delinquent customers; conducting Corporate KKB inquiries to monitor delinquent customers; managing the necessary processes to establish communication with delinquent customers who cannot be reached; initiation of enforcement proceedings against debtors via İcraTek; directing the follow-up and collection processes for customers under legal follow-up to the relevant business unit or lawyer,

To the Business Partners intermediaries for the purpose of transmitting the appraisal report to intermediary institutions for the sale and pre-sale processes of properties acquired by the bank in lieu of receivables; execution of the pre-sale and sale processes of properties acquired by the bank in lieu of receivables.

To the Private Legal Entities (Banks) for the purpose of fulfilling obligations under FATCA,

To the Authorized Public Institutions and Organizations (OFAC) for the purpose of fulfilling the information requests of the counterparty bank,

• Due to the necessity of data processing for the legitimate interests of the data controller, in compliance with Article 5/2(f),

Data is transferred to the Suppliers and External Service/Support Service Providers for the purpose of periodic profit-based reporting; execution of customer complaint tracking processes; execution of customer campaign processes; periodic profit-based reporting; reporting related to routine checks for verifying data or accounting errors; determining the credit portfolio for the issuance of asset-backed securities and the portfolio will be transferred to a fund established by our bank; conducting analytical studies for the securitization of loans to be transferred to the fund,;

To Commited Danışmanlık A.Ş. for the purpose of producing a voluntary carbon reduction certificate for customers using shopping loan in order to offset the carbon emissions arising from the production of the product they purchased by loan.

• Due to the (Article 5/1) legal basis for compliance with explicit consent,

To the Group Companies for the purpose of issuing policies and life insurance applications evaluation; obtaining information related to applicants and conducting marketing activities by the group insurance company for the purpose of providing insurance offers to customers,

To Suppliers and Assistance Service Providers for the purpose of contacting customers for providing information/marketing; engaging with customers for marketing/promotion purposes in open banking processes; sending commercial electronic messages related to insurance products; sharing guest information with the event team at the hotel for open-air cinema activities and making reservations; collecting customer feedback; offering product loans based on requests for products purchased with credit; contacting customers to ensure customer satisfaction, profiling, and conducting in-depth analysis of customer profiles; managing complaints and reputation; customer acquisition through video banking processes; conducting KKB inquiries on the Application Observation Screen for evaluating credit applications of potential customers; checking credit information used in the last 24 hours for evaluating the credit applications of potential customers; performing Check-Bill Inquiries for evaluating credit applications of potential customers; conducting Application Observations – Intelligence for evaluating credit applications of potential customers; analyzing the financial data of potential customers for credit evaluation/creditworthiness purposes through KKB inquiries; analyzing financial reports for credit evaluation/creditworthiness of potential customers; Customer acquisition (via Video banking); generating and updating Fiba Key through video banking; unblocking SIM cards through video banking; managing password operations through video banking; updating phone numbers through video banking; sending commercial electronic messages and obtaining consent for communication-related commercial electronic messages;

To the Identity Sharing System for the purpose of acquiring customer (capturing ID images via OCR); acquiring customer (scanning ID chip and capturing ID images via NFC); sharing with the Identity Sharing System for facial recognition purposes;

To the Donation Recipient Institutions for the purpose of sending certificates to customers who make donations from the organization they donated to;

To Trendyol for the grounds that the entitlement amounts that will be deposited into the customers' accounts by Trendyol are to be transferred to the customers' Fibabanka accounts. In the event that the loan obtained from Trendyol is repaid early or at the end of the term, the account information is to be updated by Trendyol regarding the provision of loans through the support service provider Trendyol,

Our company undertakes not to transfer your personal data to third parties without your explicit consent, except for the purposes mentioned above.

4. PROTECTION, STORAGE, AND DESTRUCTION OF YOUR PERSONAL DATA

Your personal data will be processed by our Company for the duration required by the purpose of processing and, in any case, retained until the end of the legal period. After the expiration of the retention period, your personal data will be deleted, destroyed, or anonymized in accordance with the LPPD legislation, in line with our Company's Personal Data Protection and Privacy Policy, Sensitive Personal Data Protection and Privacy Policy, and Personal Data Retention and Destruction Policy, from both electronic and physical environments.

Our Company shall take all necessary technical and administrative measures in accordance with the LPPD legislation to prevent your personal data from being accessed by unauthorized persons, your personal data from being processed incorrectly, disclosed, changed/deleted for reasons not in accordance with the law.

In the event of damage to your personal data due to attacks on our company’s physical archives, servers, or other systems, and/or if your data is accessed or disclosed by third parties, our company will promptly inform you and the Personal Data Protection Authority.

5. YOUR RIGHT TO INFORMATION

Under Article 11 of the LPPD, you have the right to apply to our Company and: (a) inquire whether your personal data has been processed; (b) if it has been processed, request information regarding the processing; (c) discover the purpose of the processing and whether it has been used in accordance with that purpose; (ç) be aware of the third parties to whom your data has been transferred, either domestically or abroad; (e) request the correction of incomplete or inaccurate data; (f) request the deletion or destruction of your data as part of the conditions set out in Article 7 of Law No. 6698; (f) request that the third parties to whom your personal data has been transferred be informed of the actions taken in accordance with (d) and (e); (g) object to any negative outcome arising from the exclusive analysis of your data by automated systems; and (ğ) demand compensation for any damages incurred due to unlawful processing of your personal data.

6. YOUR REQUESTS

If you have any questions or requests regarding the processing of your personal data as part of this Privacy Notice, you can apply to our Company via Registered E-Mail System.

Our Company, in accordance with Article 13 of the LPPD, will finalize your application requests based on the nature of the request within a maximum of 30 (thirty) days. If the process requires a cost, the tariff determined by the Personal Data Protection Board will be applied. In the event of a rejection of your request, the reason(s) for the rejection will be stated in our response.

If you believe that the personal data processed by our Company is not up to date, incomplete, or inaccurate, please contact us immediately at fibabanka.kisiselveri@hs03.kep.tr for any updates to the relevant personal data.

This Privacy Notice may be updated in order to comply with changing conditions and legal regulations. You can follow the updates at https://www.fibabanka.com.tr/.

DATA CONTROLLER

FİBABANKA ANONİM ŞİRKETİ