This notice is provided by Başkent Menkul Değerler A.Ş. (“Company”), in its capacity as the data controller, in accordance with the Personal Data Protection Law No. 6698 (“Law”), which entered into force to protect the fundamental rights and freedoms of individuals, particularly the right to privacy, in the processing of personal data, in order to inform you.
As the Company, we hereby inform you that we process your personal data in accordance with the Law, based on the principles of processing lawfully and fairly, ensuring accuracy and, where necessary, keeping data up to date, processing for specific, explicit and legitimate purposes, ensuring that processing is relevant, limited and proportionate to such purposes, and securely retaining personal data for the periods stipulated by the applicable legislation or required for the purposes for which they are processed.
1. What Is Personal Data?
Personal data refers to any information relating to an identified or identifiable natural person. By way of example, information such as name, surname, Turkish ID number, address, telephone number, e-mail address, date of birth, IP address, and transaction-related information falls within the scope of personal data. Furthermore, under the Personal Data Protection Law, data such as race, ethnic origin, political opinion, religious belief, health, sexual life, criminal convictions, biometric data, and genetic data are classified as special categories of personal data.
2. What Does the Processing of Personal Data Mean?
The processing of personal data refers to any operation performed on personal data, whether wholly or partly by automated means or, provided that they form part of a data recording system, by non-automated means, including the collection, recording, storage, preservation, alteration, reorganization, disclosure, transfer, acquisition, classification, or prevention of the use of such data.
3. Identity of the Data Controller
Under the Personal Data Protection Law, the data controller refers to the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.
| Information | Details |
|---|---|
| MERSIS Number | 0148000884800012 |
| Registered Office Address | Abide-i Hürriyet Cad. Bolkan Center C Blok No:211 K:6 Şişli / İstanbul |
| Telephone | (0212) 231 33 30 |
| Registered Electronic Mail (KEP) | baskentmenkul@hs03.kep.tr |
| E-mail Address | baskentmenkul@baskentmenkul.com.tr |
4. Your Personal Data Processed
The personal data processed by the Company are processed in line with the general principles set out in the Law, for specific, explicit, and legitimate purposes, and in a manner that is relevant, limited, and proportionate to such purposes.
| Data Category | Description |
|---|---|
| Identity Information | Name, surname, date and place of birth, mother's and father's name, type and number of identity document, nationality, copy/image of identity document, maiden name, professional registration number, and signature specimen. |
| Visual and Audio Data | Camera recordings, photographs used for identity verification, images of identity cards or passports, and voice recordings obtained during communications. |
| Special Categories of Personal Data | Video interview recordings obtained during the remote identity verification process, records relating to facial biometric verification, biometric photograph stored on the identity card chip, and certain special category data contained on the identity document. |
| Contact Information | Telephone number, e-mail address, postal address, and fax number. |
| Financial Information | Account number, bank and IBAN information, credit and debit card numbers, portfolio assets, income information, and tax information. |
| Education and Professional Experience Information | Employer, employment period, industry, job title, education level, companies in which you hold shares, and position-related information. |
| Risk Management Information | Purpose of account opening, asset and source of funds information, capital markets experience, transaction volume and frequency, shareholding ratio, trading restriction information, and collateral information. |
| Transaction Security Information | IP address, device and model information, user account and password information, location data, log records, browser and time zone information, and traffic data. |
| Customer Transaction Information | Transaction history, requests, and complaint data relating to products and services. |
| Marketing Information | Market research, surveys, behavioral modelling, call center records, cookie records, and data relating to marketing campaigns. |
| Legal Transaction Information | Correspondence, litigation, enforcement and execution files, mediation records, and legal records relating to accounts. |
| Physical Premises Security Information | Records of entry to and exit from physical premises and camera recordings. |
5. Methods and Legal Grounds for Collecting Your Personal Data
Your personal data are collected verbally, in writing, physically and/or electronically, through automated or non-automated methods, and retained for reasonable periods as specified under the applicable legislation.
Pursuant to Articles 5/1 and 6/2 of the Law, certain personal data may be processed based on your explicit consent following the information provided to you.
- Biometric data obtained during the remote identity verification process, including video interviews, facial biometric verification, liveness detection, and verification of security features.
- Identity, contact, professional experience, financial, marketing, and customer transaction data processed for product and service development, improvement of service quality, market research, customer satisfaction activities, and campaign and marketing activities in line with your commercial electronic communication preferences.
6. Purposes for Processing Your Personal Data
- Fulfilling notification obligations
- Managing information security processes
- Conducting audit, compliance, and ethics activities
- Managing finance and accounting operations
- Managing legal processes and resolving disputes
- Conducting internal audit, internal control, and risk management activities
- Managing customer relations and customer satisfaction
- Carrying out identity verification and know-your-customer processes
- Performing investment services and capital market activities within the scope of capital markets legislation
- Establishing contracts and fulfilling contractual obligations
- Managing communication, advertising, promotion, marketing, and campaign activities relating to products and services
- Managing requests and complaints
- Managing sales and after-sales support processes
7. Transfer of Your Processed Personal Data
Your personal data may be shared with the following parties, limited to the purposes specified below, in accordance with Articles 8 and 9 of the Law and subject to the implementation of the necessary administrative and technical security measures:
| Recipients of the Transfer | Purpose of the Transfer |
|---|---|
| Authorized public institutions and organizations and judicial authorities | To fulfill legal obligations arising from applicable legislation, respond to requests for information and documentation, and conduct statutory reporting and audit processes. |
| Natural or legal persons from whom outsourced services are obtained | To carry out legal, financial, audit, consultancy, communication, advertising, security, postal/courier, software, audio/video communication, and information technology services. |
| Capital market institutions and other business partners | To carry out domestic and international capital market activities. |
| Shareholders, affiliates, and group companies | To manage customer relationships, determine corporate strategies, conduct risk management activities, and fulfill legal obligations. |
Within the scope of Article 9 of the Law, certain personal data may be transferred, based on your explicit consent, to overseas service providers and organizations providing services in remote identity verification processes.
8. Your Rights Under the Law
- To learn whether your personal data are being processed
- To request information if your personal data have been processed
- To learn the purpose of processing and whether your personal data are used in accordance with that purpose
- To know the third parties to whom your personal data are transferred, whether domestically or abroad
- To request the correction of incomplete or inaccurate personal data
- To request the deletion or destruction of your personal data under the conditions set forth in the Law
- To object to a result arising against you through the analysis of your personal data exclusively by automated systems
- To request compensation for damages incurred due to the unlawful processing of your personal data
9. Procedure for Exercising Your Rights
You may submit your requests within the scope of Article 11 of the Law to the Company in writing, via your registered electronic mail (KEP) address, by secure electronic signature, mobile signature, or through the electronic mail address previously notified to the Company and registered in its systems.
Your application must include your name and surname, signature, Turkish ID number (or passport/identity number for foreign nationals), notification address, if available your e-mail address, telephone and fax number, and the subject of your request. Applications will be concluded as soon as possible and, in any event, within thirty (30) days at the latest. Applications are free of charge as a rule; however, if a fee has been determined by the Personal Data Protection Board, the relevant fee may be charged.
| Full Name | |
| Turkish ID Number | |
| Date | |
| Signature |