KVKK Policy
POLICY ON THE PROTECTION AND PROCESSING OF PERSONAL DATA
SERVİSSOFT ARAŞTIRMA GELİŞTİRME DANIŞMANLIK YAZILIM HİZMETLERİ ANONİM ŞİRKETİ GENERAL DECLARATION ON THE PROTECTION AND PROCESSING OF PERSONAL DATA
Information Statement
Definitions and Terms: Personal Data: Refers to any information relating to an identified or identifiable natural person. Such information includes data such as name, surname, date of birth, T.C. identity number, telephone number, e-mail address and IP address (the set of numbers specifically assigned to each device connected to packet-switched networks using the internet, which such devices use to exchange data with one another over the network). Data Controller: Refers to the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data filing system. Data Processor: Refers to the natural or legal person who processes personal data on behalf of the data controller on the basis of the authority granted by the data controller. Explicit Consent: Refers to consent relating to a specific matter, based on information and given with free will. Anonymisation: Refers to rendering personal data impossible to associate with an identified or identifiable natural person, even by matching it with other data. Processing of Personal Data: Refers to any operation performed on data, such as obtaining, recording, storing, preserving, altering, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data. Special Categories of Personal Data: Personal data such as data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. Data Breach: Refers to the disclosure, alteration or destruction of personal data by unauthorised persons as a result of its unlawful processing, access or loss. Data Processing Inventory: Refers to the inventory of the personal data processing activities carried out by data controllers, including the purposes of processing, data categories, recipient groups to whom data is transferred, data subject groups and the methods used in the processing process. Authority: Refers to the Personal Data Protection Authority. The Authority is the independent administrative authority that carries out regulation and supervision relating to the protection of personal data. Data Owner: Refers to the natural person whose personal data is processed. The data owner may also be referred to as the “data subject”. Data Subject: Refers to the natural person whose personal data is processed. The data subject has the right to obtain information and exercise his or her rights by applying to the data controller regarding the processing of his or her personal data. Third Party: Refers to the natural or legal persons to whom personal data may be transferred. Such persons are persons other than the data controller and the data processor. Data Filing System: Refers to the filing system in which personal data is processed by being structured according to certain criteria. Data Management and Representation Within the scope of the KVKK, namely the Law No. 6698 on the Protection of Personal Data, SERVİSSOFT ARAŞTIRMA GELİŞTİRME DANIŞMANLIK YAZILIM HİZMETLERİ ANONİM ŞİRKETİ (hereinafter referred to as “SERVİSSOFT”) processes your personal data as data controller. SERVİSSOFT seriously fulfils its obligation to protect the privacy of customer information and to ensure that such information is not shared with unauthorised persons. In this context, all personnel working at our company undertake to use the information they learn while performing their functions only within legal limits and as required by their duties. Our employees are also responsible for complying with the legislation on customer confidentiality and the protection of personal information. Detailed information on the Protection and Processing of Personal Data is available on our institution’s website. Our relevant policies have been carefully prepared to ensure the security of the data of you, our valued customers, and are updated regularly. Such updates are available on our website. 3. Processing of Personal Data, Transfer Abroad and Purpose Pursuant to the KVKK, you must be informed in advance and your explicit consent must be obtained for your personal data to be processed. However, certain special cases are excluded from this general rule, namely: Public Interest: Upon the request of public institutions such as government offices. Legal Requirement: Where expressly permitted by other laws. Emergencies: Where it is not possible to give consent, for example to protect the life of a person in mortal danger. Contractual Necessity: Where necessary for the performance of a contract. Legal Obligations: Where necessary for the data controller to fulfil its legal obligations. Data Made Public: Data that has been made public by the person himself or herself. Protection of Legal Rights: Where necessary for the establishment, exercise or protection of a right. Legitimate Interest: For the legitimate interests of the data controller, provided that such processing does not harm other fundamental rights and freedoms. Outside these exceptions, obtaining your explicit consent for the processing of your personal data is the rule. SERVİSSOFT ARAŞTIRMA GELİŞTİRME DANIŞMANLIK YAZILIM HİZMETLERİ ANONİM ŞİRKETİ (“SERVİSSOFT”) processes your personal data within the framework provided by the KVKK for the following purposes, in order to provide high-standard services to the technical service and energy sectors in Türkiye and to ensure customer satisfaction: Capital Markets and Energy Market Regulatory Authority (EPDK) Services: Conducting the relevant market activities offered by SERVİSSOFT; within this scope, the promotion and management of the operational processes of various financial services such as shares, futures, options markets and leveraged trading. While offering companies in the energy sector, within the scope of the Energy Market Regulatory Authority (EPDK), solutions for regulation-compliant operational process management, digital infrastructure support, and audit and reporting processes, it also supports firms operating in financial markets such as shares, futures, options markets and leveraged trading with digital platforms and analytical tools. Legal and Regulatory Compliance: Ensuring full compliance with local and international legislation, as well as with the regulations of the regulatory bodies to which our parent company is subject; compliance with intra-group know-your-customer and risk management policies within the scope of the fight against the laundering of proceeds of crime. In addition, pursuant to the standard contract signed between us, since Amazon and Microsoft products are and will be used within the scope of the transfer of personal data abroad. Processes such as auditing, the protection of ethical standards, the management of receivables, creditworthiness assessment and the conduct of activities in compliance with legislation. In addition, the effective conduct of internal audit, investigation and intelligence activities and of risk management processes. The conduct of management activities, strategic planning, the security of data controller operations and the management of goods/services procurement processes. In addition, special cases such as the determination of risk groups under banking legislation are assessed within this scope. Technical Service Support: It offers auxiliary and supporting software that technical services may use in their general processes. Human Resources Management: The effective implementation of human resources policies, the recruitment of suitable personnel and the fulfilment of occupational health and safety obligations. Operational Efficiency and Communication: The orderly conduct of internal communication and operational activities, the management of evaluation processes relating to customers and business partners, and the continuous monitoring of risk analyses and legal compliance processes. The production of goods and services, ensuring the security of transactions (for example, QR code transactions and delivery, technical service security), document registration operations and energy forecasting operations. These processes are managed in order to ensure organisational effectiveness and customer satisfaction. Customer Relations and Marketing: The customisation of products and services in line with customer preferences, the development of effective marketing strategies and the conduct of activities aimed at customer satisfaction. These processes are supported both by information security processes and by after-sales support services for goods/services. Strategic Planning and Business Development: The determination and implementation of the institution’s general commercial and business strategies, supported by sectoral analyses and market research. Financial and Administrative Management: The coordination of finance, communication and market research activities, the management of internal systems and applications, and the management of procurement and legal transactions. Corporate Reputation and Relationship Management: The management of business partnerships and supplier relationships, corporate social responsibility projects, and the protection and enhancement of the company’s image in society. Business and Contract Management: Processes such as the processing of personal data of contracting parties, the receipt and evaluation of suggestions for the improvement of business processes, and the conduct of communication activities. Physical and Information Security: Ensuring the security of physical premises, conducting information security processes and following up legal affairs. 4. Transfer of Personal Data Personal data managed by SERVİSSOFT ARAŞTIRMA GELİŞTİRME DANIŞMANLIK YAZILIM HİZMETLERİ ANONİM ŞİRKETİ (“SERVİSSOFT”) in accordance with the law and the principles of good faith, within the framework of the Law on the Protection of Personal Data (KVKK), is processed for specified, explicit and legitimate purposes and is retained only to the extent limited to such purposes. Personal data is kept accurate and up to date, in a manner consistent with the purposes of processing, and is retained for as long as necessary. This process is carried out in accordance with the legal conditions set out in Articles 8 and 9 of the KVKK. SERVİSSOFT takes the necessary security measures during the transfer of personal data and processes such data on servers and in other electronic environments located in Türkiye and abroad that have appropriate security standards. Such transfers are carried out within the scope of the purposes explained in the previously defined “Purposes of Processing of Personal Data” section, and the data is retained for the periods provided for in the relevant law and necessary for the purpose of processing. In this context, SERVİSSOFT may transfer your personal data to third parties in Türkiye and abroad. Such transfer activities are organised in a manner that ensures the protection of the data, and the security of your personal data is maintained at the highest level. Each transfer is carried out in compliance with the relevant legal regulations, taking into account the technical and administrative measures for the protection of data determined by the Personal Data Protection Authority and by institutions such as MASAK, EPDK and SPK. 4. Collection of Personal Data, Method and Legal Grounds Your personal data is collected by SERVİSSOFT ARAŞTIRMA GELİŞTİRME DANIŞMANLIK YAZILIM HİZMETLERİ ANONİM ŞİRKETİ (“SERVİSSOFT”), in line with the Capital Markets Law No. 6362 and other related legislation, through contracts, information forms and other documents issued in connection with the investment and capital markets services offered by SERVİSSOFT. Such collection is carried out through notifications made with your approval and/or electronic signature, written or digital applications made to sales teams, and similar means. Collection Channels: Head Office and branches, Internet transactions, Electronic trading platforms used for capital markets activities, Customer meetings, Various oral, written or electronic media such as telephone recordings. These processes are carried out wholly or partly by automated systems, or by non-automated methods as part of a data filing system. Your personal data may also be obtained from our affiliates in Türkiye and abroad, the programme partner institutions and organisations with which we cooperate, third parties from which services are outsourced, official institutions, domestic and foreign banks, investment firms, the exchanges and markets on which transactions are carried out, custodians and other third parties. SERVİSSOFT acts in accordance with the relevant legislation in the process of collecting and processing your personal data and takes all necessary security measures to protect the data. This information is used to improve the quality of the services offered by SERVİSSOFT and to provide you with a better service. SERVİSSOFT ARAŞTIRMA GELİŞTİRME DANIŞMANLIK YAZILIM HİZMETLERİ ANONİM ŞİRKETİ (“SERVİSSOFT”), as a leading institution in the field of capital markets in Türkiye, collects and processes your personal data in compliance with the KVKK and the Capital Markets Law No. 6362. This process is mandatory for the effective provision of the products and services we offer and for the conduct of our investment and capital markets services. Personal Data Collection Channels and Purposes: We collect your personal data through various channels such as the head office, call centres, websites, mobile applications, ATMs (if installed) and electronic trading platforms. Your identity information, contact information (address, telephone number, e-mail address), account information, biometric and health data, tax number and other personal information are recorded in order to identify and carry out your transactions correctly. Legal Obligations and Security Needs: The personal data collected is processed in order to comply with the information retention, reporting and notification obligations prescribed by judicial and administrative authorities such as the Capital Markets Board (SPK), Borsa İstanbul (BİST), the Turkish Capital Markets Association (TSPB), the Central Bank of the Republic of Türkiye (TCMB), the Financial Crimes Investigation Board (MASAK), the Revenue Administration (GİB), the Investor Compensation Centre (YTM), Takasbank and the Central Registry Agency (MKK), and the Energy Market Regulatory Authority (EPDK). Such data may also be processed for reasons such as security, crime prevention and our legitimate interests, and is processed within the framework of the relevant legal regulations. Conditions for the Processing of Personal Data: SERVİSSOFT processes your personal data within the framework of the processing conditions provided by the KVKK and, in particular, provided that it does not harm the fundamental rights and freedoms of the data subjects. Your special categories of personal data are processed only within the relevant legal permissions and under principles of a high degree of protection and confidentiality. This information is used to fulfil the requirements of the contracts signed with you and to provide you with a better service. SERVİSSOFT takes all necessary measures for the protection and security of your personal data and processes and retains such data in accordance with the law. Identity Verification and Use of Biometric Data: Our application may use various biometric verification methods in order to ensure your security and verify your identity. These methods may include steps such as ID reading, facial recognition, fingerprint scanning and liveness checks. The following information may be collected and processed during these verification processes: Identity Information: Scanning of your identity card, passport or other official identity documents. Biometric Data: Biometric verification methods such as facial recognition and fingerprint scanning. Liveness Check: Liveness checks may be performed to verify your identity. This may involve short videos or photographs being taken through your camera. User Consent and Information The security and privacy of our users are important to us. Therefore, we provide our users with the following information regarding identity verification and the use of biometric data: Information: We will provide clear and understandable information about the processes in which identity verification and biometric data will be used. Consent: We will obtain the explicit consent of our users before initiating these verification processes. Data Security: The biometric data collected will be protected with high security measures and will be used solely for identity verification purposes. Privacy Rights: Our users have the following rights regarding the processing of their personal data: Access and Rectification: You have the right to access your personal data and to have such data rectified. Erasure: You may request the erasure of your personal data under certain conditions. Objection: You have the right to object to the processing of your personal data. Contact: If you have any questions or concerns regarding identity verification and the use of biometric data, please contact us using the contact details in this text. 5. Rights of the Data Subject As SERVİSSOFT ARAŞTIRMA GELİŞTİRME DANIŞMANLIK YAZILIM HİZMETLERİ ANONİM ŞİRKETİ (“SERVİSSOFT”), the rights granted to data subjects under the Law on the Protection of Personal Data (KVKK) are as follows: To learn whether personal data is being processed. To obtain detailed information regarding processed personal data. To inquire into the purpose of processing of personal data and whether it is used in accordance with its purpose. To learn to which third parties in Türkiye or abroad personal data has been transferred. To request the rectification of incompletely or inaccurately processed personal data and to request that such rectification be notified to the relevant third parties. To request the erasure or destruction of personal data when the reasons requiring its processing cease to exist, and to request that such operations be notified to the relevant third parties. To object to a decision against the person resulting from the processing of personal data entirely by automated systems. To request compensation for damage suffered as a result of the unlawful processing of personal data. Applications required for the exercise of these rights may be made by completing the form provided by SERVİSSOFT, signing it with a wet signature and sending it by post to the company’s physical address below, or may be submitted electronically by e-mail to the account also set out below. Where the procedures are carried out duly, requests are evaluated and concluded within thirty days at the latest. If the relevant operations require additional cost, a fee may be charged according to the tariff determined under the KVKK. Your Rights Regarding Your Personal Data Data subjects must first apply to the data controller in order to exercise their rights regarding their personal data. Pursuant to Article 14 of the Law, a complaint may not be lodged directly with the Personal Data Protection Board. Under the Law, you have the following rights regarding your personal data: To learn whether your personal data is being processed, If your personal data has been processed, to request information in this regard, To learn the purpose of processing of your personal data and whether they are used in accordance with their purpose, To know the third parties to whom your personal data is transferred domestically or abroad, To request the rectification of your personal data if it has been processed incompletely or inaccurately, To request the erasure or destruction of your personal data if the reasons requiring its processing have ceased to exist, To request that the operations carried out pursuant to subparagraphs (5) and (6) be notified to the third parties to whom your personal data has been transferred, To object to the occurrence of a result against you by means of the analysis of your processed data exclusively through automated systems, To request compensation for damages in the event of suffering damage due to the unlawful processing of personal data. You may exercise these rights by applying to the data controller, that is, to us. Method of Application to the Data Controller You may submit your application by the following methods: Address: In writing to the address Çobançeşme Mahallesi Can Sokak 12/1 Kat: 3 Daire: 5 Bahçelievler/İstanbul; Registered Electronic Mail (KEP): To the registered electronic mail address servissoft@hs01.kep.tr, using your own KEP address; E-mail: By sending an e-mail to info@servissoft.net using your e-mail address registered in our system. Your application must contain the following information: Your name, surname and, if the application is in writing, your signature, For citizens of the Republic of Türkiye, your T.C. identity number; for foreign nationals, your nationality, passport number or, if any, identity number, Your address of residence or workplace for the purposes of notification, If any, your e-mail address, telephone and fax number for the purposes of notification, The subject of your request. Any information and documents relating to the matter should also be attached to your application.
Example Form:
https://docs.google.com/document/d/1QbvY3Lzn49QlN_Q_CsaUJeZU3NFVczLKvnZCrVN4ehE/edit?tab=t.0
Your application will be concluded within thirty days and: may be accepted, and you may be informed regarding your request, or may be rejected, with the reasons stated. More detailed information on the procedures and principles to be followed when making an application is available in the Personal Data Protection Authority’s in Türkiye and translated name is(it is not an official tranlation); “Communiqué on the Procedures and Principles for Applications to the Data Controller”.
This Policy has been prepared in Turkish and English. In the event of any conflict or discrepancy in interpretation between the two versions, the Turkish version shall prevail.