Odea Bank A.Ş. Personal Data Protection and Processing Policy

Inform Texts

a) Data Controller and Data Controller's Agent

Your personal data may be processed and transferred by Odea Bank Anonim Sirketi, (the "Bank") acting in the capacity of the data controller, in accordance with the Law Nr.6698 on the Protection of Personal Data (the "Law"), subject to the limitations specified below.

Data Controller: Odeabank A.Ş.
Adress: Esentepe Mahallesi Büyükdere Cad. Levent 199 Apt. No:199/119 Şişli/İstanbul
Mersis ID: 0-6340-4219-7300010
Contact: +90 212 304 84 44

b) Personal Data & Purpose of Processing of Personal Data

Odea Bank A.Ş. ("OdeaBank") processes your personal data specified below to be limited to the purposes specified in the Inform Text For Credit Product Processes.

Personal Data Category	Purpose of Data Processing	Legal Reason
Contact Information	Planning and/or execution of the necessary operational activities to ensure that the Bank's activities are carried out in accordance with the Bank's procedures and/or relevant legislation in the credit product process of our Bank, Ensuring the legal, technical and commercial-business security of data subject, Execution of Information Security Processes, Execution of Activities in Compliance with Legislation, Execution of Communication Activities, Execution of Activities for Customer Satisfaction, Execution of Storage and Archive Activities, Execution of Contract Processes, Follow-up of Requests / Complaints, Execution of Marketing Processes of Products / Services, Execution of Goods / Services After Sales Support Services, Execution of Goods / Services Sales Processes, Execution of Goods / Service Production and Operation Processes, Execution of Customer Relationship Management Processes, Providing Information to Authorized Persons, Institutions and Organizations, Follow-up and Execution of Legal Affairs	It is expressly provided for by the laws, Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, It is necessary for compliance with a legal obligation to which the data controller is subject.
Contact Information	Sending commercial electronic messages by sending SMS, E-Mail and making calls for advertising and promotional purposes regarding the products and/or services of the Bank for the purpose of marketing related to the product/service used (directly) or products equivalent to the product/service, limited to the framework of the established service relationship	Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.
Identity Information	Planning and/or execution of the necessary operational activities to ensure that the Bank's activities are carried out in accordance with the Bank's procedures and/or relevant legislation in the credit product process of our Bank, Ensuring the legal, technical and commercial-business security of data subject, Execution of Information Security Processes, Execution of Activities in Compliance with Legislation, Execution of Communication Activities, Execution of Activities for Customer Satisfaction, Execution of Storage and Archive Activities, Execution of Contract Processes, Follow-up of Requests / Complaints, Execution of Marketing Processes of Products / Services, Execution of Goods / Services After Sales Support Services, Execution of Goods / Services Sales Processes, Execution of Goods / Service Production and Operation Processes, Execution of Customer Relationship Management Processes, Providing Information to Authorized Persons, Institutions and Organizations, Follow-up and Execution of Legal Affairs, Conducting Internal Audit / Investigation / Intelligence Activities	It is expressly provided for by the laws, Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, It is necessary for compliance with a legal obligation to which the data controller is subject.
Finance Information	Planning and/or execution of the necessary operational activities to ensure that the Bank's activities are carried out in accordance with the Bank's procedures and/or relevant legislation in the credit product process of our Bank, Evaluation of applications for the credit product process and realization of transactions regarding the outcome, Ensuring the legal, technical and commercial-business security of data subject, Execution of Information Security Processes, Execution of Activities in Compliance with Legislation, Execution of Communication Activities, Execution of Activities for Customer Satisfaction, Execution of Storage and Archive Activities, Execution of Contract Processes, Follow-up of Requests / Complaints, Execution of Marketing Processes of Products / Services, Execution of Goods / Services After Sales Support Services, Execution of Goods / Services Sales Processes, Execution of Goods / Service Production and Operation Processes, Execution of Customer Relationship Management Processes, Providing Information to Authorized Persons, Institutions and Organizations, Follow-up and Execution of Legal Affairs, Execution of Internal Audit / Investigation / Intelligence Activities, Execution of Finance and Accounting Affairs	It is expressly provided for by the laws, Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, It is necessary for compliance with a legal obligation to which the data controller is subject.
Risk Management Information	Execution of Risk Management Processes in the credit product process of our Bank, Planning and/or execution of the necessary operational activities to ensure that the Bank's activities are carried out in accordance with the Bank's procedures and/or relevant legislation in the credit product process of our Bank, Evaluation of applications for the credit product process and realization of transactions regarding the outcome, Ensuring the legal, technical and commercial-business security of data subject, Execution of Information Security Processes, Execution of Activities in Compliance with Legislation, Execution of Storage and Archive Activities, Follow-up of Demands / Complaints, Execution of Marketing Processes of Products / Services, Execution of Intelligence Activities, Execution of Audit / Ethical Activities, Execution of Access Authorizations, Execution of Finance and Accounting Affairs, Follow-up and Execution of Legal Affairs, Providing Information to Authorized Persons, Institutions and Organizations	It is expressly provided for by the laws, Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, It is necessary for compliance with a legal obligation to which the data controller is subject, Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.
Professional Experience Information	Planning and/or execution of the necessary operational activities to ensure that the Bank's activities are carried out in accordance with the Bank's procedures and/or relevant legislation in the credit product process of our Bank, Ensuring the legal, technical and commercial-business security of data subject, Execution of Activities in Compliance with Legislation, Execution of Activities for Customer Satisfaction, Execution of Storage and Archive Activities, Execution of Contract Processes, Follow-up of Demands / Complaints, Execution of Marketing Processes of Products / Services, Execution of Investment Processes, Execution of Marketing Processes of Products / Services, Execution of Goods / Service After Sales Support Services, Execution of Goods / Service Sales Processes, Execution of Goods / Service Production and Operation Processes, Providing Information to Authorized Persons, Institutions and Organizations	It is expressly provided for by the laws, Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, It is necessary for compliance with a legal obligation to which the data controller is subject.
Transaction Security Information	Planning and/or execution of the necessary operational activities to ensure that the Bank's activities are carried out in accordance with the Bank's procedures and/or relevant legislation in the credit product process of our Bank, Ensuring the legal, technical and commercial-business security of data subject, Execution of Information Security Processes, Execution of Activities in Compliance with Legislation, Execution of Storage and Archive Activities, Follow-up of Demands / Complaints, Execution of Access Authorizations, Follow-up and Execution of Legal Affairs, Conducting Internal Audit / Investigation / Intelligence Activities, Conducting Communication Activities, Conducting Risk Management Processes, Ensuring the Security of Data Controller Operations, Providing Information to Authorized Persons, Institutions and Organizations,	It is expressly provided for by the laws, Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, It is necessary for compliance with a legal obligation to which the data controller is subject.
Legal Process Information	Conducting Audit / Ethics Activities, Follow-up and Execution of Legal Affairs, Conducting Internal Audit / Investigation / Intelligence Activities, Evaluation of applications for the credit product process and realization of transactions regarding the outcome, Execution of Storage and Archive Activities, Providing Information to Authorized Persons, Institutions and Organizations, Execution of Activities in Compliance with Legislation, Execution of Risk Management Processes, Follow-up of Demands / Complaints,	It is expressly provided for by the laws, Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, It is necessary for compliance with a legal obligation to which the data controller is subject.
Audiovisual Recordings	Execution of Communication Activities, Execution of Customer Relationship Management Processes, Execution and planning of Contract Processes, Execution of Storage and Archive Activities, Follow-up and Execution of Legal Affairs, Execution of Activities in Compliance with Legislation, Follow-up of customer requests and/or complaints and planning and/or execution of internal audit/internal control/investigation/intelligence activities ex officio or upon complaint,	It is expressly provided for by the laws, Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract., It is necessary for compliance with a legal obligation to which the data controller is subject.

c) Method for Collection of Personal Data, and Legal Reason(s) Thereto

Your Personal Data is processed securely by digital, electronic and printed methods. Your personal data is processed for the purposes, methods and legal reasons stated above.

ç) Transfer of Personal Data

Odea Bank A.Ş. ("OdeaBank") may transfer your personal data mentioned above to our shareholders located in Turkey or abroad, legally authorized public institutions and organizations, our business partners and suppliers who have the title of data processor, in accordance with Article 73 of the Banking Law No. 5411, limited to the purposes stated above within the scope of the Inform Text For Credit Product Processes, by complying with the principle of proportionality and by executing a confidentiality agreement.

d) Rights of Personal Data Owners Provided under Section 11 of the Law

As a data subject, if you submit your requests regarding your rights to our Bank by the methods shown in the Procedures and Principles for Application to the Data Controller, which has been shared with the public at www.odeabank.com.tr, the Bank will finalize the request free of charge as soon as possible and within thirty (30) days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, the Bank will charge the fee in the tariff determined by the Personal Data Protection Board. In this context, personal data owners:

a) to learn whether his/her personal data are processed or not,
b) to demand for information as to if his/her personal data have been processed,
c) to learn the purpose of the processing of his/her personal data and whether these personal
data are used in compliance with the purpose,
ç) to know the third parties to whom his personal data are transferred in country or abroad,
d) to request the rectification of the incomplete or inaccurate data, if any,
e) to request the erasure or destruction of his/her personal data under the conditions referred to in Article 7,
f) to request reporting of the operations carried out pursuant to sub-paragraphs (d) and (e) to third parties to whom his/her personal data have been transferred,
g) to object to the occurrence of a result against the person himself/herself by analyzing the data processed solely through automated systems,
ğ) to claim compensation for the damage arising from the unlawful processing of his/her personal data.

You can apply to Odea Bank A.Ş., which is the data controller under the Law, from the link below:
https://www.odeabank.com.tr/en/contact-us

a) Data Controller and Data Controller's Agent

Data Controller: Odeabank A.Ş.
Adress: Esentepe Mahallesi Büyükdere Cad. Levent 199 Apt. No:199/119 Şişli/İstanbul
Mersis ID: 0-6340-4219-7300010
Contact: +90 212 304 84 44

b) Personal Data & Purpose of Processing of Personal Data

Odea Bank A.Ş. ("OdeaBank") processes your personal data specified below to be limited to the purposes specified in the Inform Text for Customer Acquisition Processes.

Kişisel Veri Kategorisi ve Kişisel Veri	Veri İşlenme Amacı	Hukuki Sebep
Contact Information	Planning and/or execution of the necessary operational activities to ensure that the Bank's activities are carried out in accordance with the Bank's procedures and/or relevant legislation in the Customer Acquisition Processes of our Bank, Ensuring the legal, technical and commercial-business security of data subject, Execution of Information Security Processes, Execution of Activities in Compliance with Legislation, Execution of Communication Activities, Execution of Activities for Customer Satisfaction, Execution of Storage and Archive Activities, Execution of Contract Processes, Follow-up of Requests / Complaints, Execution of Marketing Processes of Products / Services, Execution of Goods / Services After Sales Support Services, Execution of Goods / Services Sales Processes, Execution of Goods / Service Production and Operation Processes, Execution of Customer Relationship Management Processes, Providing Information to Authorized Persons, Institutions and Organizations, Follow-up and Execution of Legal Affairs	It is expressly provided for by the laws, Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, It is necessary for compliance with a legal obligation to which the data controller is subject
Contact Information	Sending commercial electronic messages by sending SMS, E-Mail and making calls for advertising and promotional purposes regarding the products and/or services of the Bank for the purpose of marketing related to the product/service used (directly) or products equivalent to the product/service, limited to the framework of the established service relationship	Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.
Identity Information	Planning and/or execution of the necessary operational activities to ensure that the Bank's activities are carried out in accordance with the Bank's procedures and/or relevant legislation in the Customer Acquisition Processes of our Bank, Ensuring the legal, technical and commercial-business security of data subject, Execution of Information Security Processes, Execution of Activities in Compliance with Legislation, Execution of Communication Activities, Execution of Activities for Customer Satisfaction, Execution of Storage and Archive Activities, Execution of Contract Processes, Follow-up of Requests / Complaints, Execution of Marketing Processes of Products / Services, Execution of Goods / Services After Sales Support Services, Execution of Goods / Services Sales Processes, Execution of Goods / Service Production and Operation Processes, Execution of Customer Relationship Management Processes, Providing Information to Authorized Persons, Institutions and Organizations, Follow-up and Execution of Legal Affairs, Conducting Internal Audit / Investigation / Intelligence Activities	It is expressly provided for by the laws, Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, It is necessary for compliance with a legal obligation to which the data controller is subject,
Finance Information	Planning and/or execution of the necessary operational activities to ensure that the Bank's activities are carried out in accordance with the Bank's procedures and/or relevant legislation in the Customer Acquisition Processes of our Bank, Ensuring the legal, technical and commercial-business security of data subject, Execution of Information Security Processes, Execution of Activities in Compliance with Legislation, Execution of Communication Activities, Execution of Activities for Customer Satisfaction, Execution of Storage and Archive Activities, Execution of Contract Processes, Follow-up of Requests / Complaints, Execution of Marketing Processes of Products / Services, Execution of Goods / Services After Sales Support Services, Execution of Goods / Services Sales Processes, Execution of Goods / Service Production and Operation Processes, Execution of Customer Relationship Management Processes, Providing Information to Authorized Persons, Institutions and Organizations, Follow-up and Execution of Legal Affairs, Execution of Internal Audit / Investigation / Intelligence Activities, Execution of Finance and Accounting Affairs	It is expressly provided for by the laws, Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, It is necessary for compliance with a legal obligation to which the data controller is subject,
Müşteri İşlem Bilgisi	Planning and/or execution of the necessary operational activities to ensure that the Bank's activities are carried out in accordance with the Bank's procedures and/or relevant legislation in the Customer Acquisition Processes of our Bank, Ensuring the legal, technical and commercial-business security of data subject, Execution of Information Security Processes, Execution of Activities in Compliance with Legislation, Execution of Communication Activities, Execution of Activities for Customer Satisfaction, Execution of Storage and Archive Activities, Execution of Contract Processes, Follow-up of Requests / Complaints, Execution of Marketing Processes of Products / Services, Execution of Goods / Services After Sales Support Services, Execution of Goods / Services Sales Processes, Execution of Goods / Service Production and Operation Processes, Execution of Customer Relationship Management Processes, Providing Information to Authorized Persons, Institutions and Organizations, Follow-up and Execution of Legal Affairs, Conducting Internal Audit / Investigation / Intelligence Activities	It is expressly provided for by the laws, Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, It is necessary for compliance with a legal obligation to which the data controller is subject,,
Risk Management Information	Planning and/or execution of the necessary operational activities to ensure that the Bank's activities are carried out in accordance with the Bank's procedures and/or relevant legislation in the Customer Acquisition Processes of our Bank, Ensuring the legal, technical and commercial-business security of data subject, Execution of Information Security Processes, Execution of Activities in Compliance with Legislation, Execution of Storage and Archive Activities, Follow-up of Demands / Complaints, Execution of Marketing Processes of Products / Services, Execution of Intelligence Activities, Execution of Audit / Ethical Activities, Execution of Access Authorizations, Execution of Finance and Accounting Affairs, Follow-up and Execution of Legal Affairs, Providing Information to Authorized Persons, Institutions and Organizations	It is expressly provided for by the laws, Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, It is necessary for compliance with a legal obligation to which the data controller is subject, Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject
Professional Experience Information	Planning and/or execution of the necessary operational activities to ensure that the Bank's activities are carried out in accordance with the Bank's procedures and/or relevant legislation in the Customer Acquisition Processes of our Bank, Ensuring the legal, technical and commercial-business security of data subject, Execution of Activities in Compliance with Legislation, Execution of Activities for Customer Satisfaction, Execution of Storage and Archive Activities, Execution of Contract Processes, Follow-up of Demands / Complaints, Execution of Marketing Processes of Products / Services, Execution of Investment Processes, Execution of Marketing Processes of Products / Services, Execution of Goods / Service After Sales Support Services, Execution of Goods / Service Sales Processes, Execution of Goods / Service Production and Operation Processes, Providing Information to Authorized Persons, Institutions and Organizations	It is expressly provided for by the laws, Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, It is necessary for compliance with a legal obligation to which the data controller is subject,
Transaction Security Information	Planning and/or execution of the necessary operational activities to ensure that the Bank's activities are carried out in accordance with the Bank's procedures and/or relevant legislation in the Customer Acquisition Processes of our Bank, Ensuring the legal, technical and commercial-business security of data subject, Execution of Information Security Processes, Execution of Activities in Compliance with Legislation, Execution of Storage and Archive Activities, Follow-up of Demands / Complaints, Execution of Access Authorizations, Follow-up and Execution of Legal Affairs, Conducting Internal Audit / Investigation / Intelligence Activities, Conducting Communication Activities, Conducting Risk Management Processes, Ensuring the Security of Data Controller Operations, Providing Information to Authorized Persons, Institutions and Organizations,	It is expressly provided for by the laws, Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, It is necessary for compliance with a legal obligation to which the data controller is subject,
Legal Process Information	Conducting Audit / Ethics Activities, Follow-up and Execution of Legal Affairs, Conducting Internal Audit / Investigation / Intelligence Activities, Execution of Storage and Archive Activities, Providing Information to Authorized Persons, Institutions and Organizations, Execution of Activities in Compliance with Legislation, Execution of Risk Management Processes, Follow-up of Demands / Complaints,	It is expressly provided for by the laws, Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, It is necessary for compliance with a legal obligation to which the data controller is subject,
Location Information	Execution of Information Security Processes, Conducting Internal Audit / Investigation / Intelligence Activities, Execution of Communication Activities, Ensuring the Security of Data Controller Operations, Providing Information to Authorized Persons, Institutions and Organizations, Follow-up of Demands / Complaints,	It is expressly provided for by the laws, Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, It is necessary for compliance with a legal obligation to which the data controller is subject,
Audiovisual Recordings	Execution of Communication Activities, Execution of Customer Relationship Management Processes, Execution and planning of Contract Processes, Execution of Storage and Archive Activities, Follow, Follow-up and Execution of Legal Affairs, Execution of Activities in Compliance with Legislation, Follow-up of customer requests and/or complaints and planning and/or execution of internal audit/internal control/investigation/intelligence activities ex officio or upon complaint,	It is expressly provided for by the laws, Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, It is necessary for compliance with a legal obligation to which the data controller is subject,

c) Method for Collection of Personal Data, and Legal Reason(s) Thereto

Your Personal Data is processed securely by digital, electronic and printed methods. Your personal data is processed for the purposes, methods and legal reasons stated above.

ç) Transfer of Personal Data

Odea Bank A.Ş. ("OdeaBank") may transfer your personal data mentioned above to our shareholders located in Turkey or abroad, legally authorized public institutions and organizations, our business partners and suppliers who have the title of data processor, in accordance with Article 73 of the Banking Law No. 5411, limited to the purposes stated above within the scope of the Inform Text for Customer Acquisition Processes, by complying with the principle of proportionality and by executing a confidentiality agreement.

d) Rights of Personal Data Owners Provided under Section 11 of the Law

You can apply to Odea Bank A.Ş., which is the data controller under the Law, from the link below:
https://www.odeabank.com.tr/en/contact-us