DISCLOSURE TEXT REGARDING PAPARA PAYMENT SERVICES AND ELECTRONIC MONEY USERS

The purpose of this text is to explain the procedures and principles regarding the processing of personal data by our company to the users of payment services in accordance with the Law No. 6698 on the Protection of Personal Data and relevant legislation.

This text will explain how your personal data is collected, used, shared, and other matters as outlined below:

• Which personal data does the company collect and process from you?

• For what purpose does the company collect your personal data?

• Under what legal grounds are personal data processed?

• What are the methods of collecting your personal data?

• To whom and for what purposes are your personal data transferred?

• What are your rights as the data subject?

• What is the process for applying and complaining regarding your personal data?

DATA CONTROLLER

Your personal data is processed by Papara Elektronik Para A.Ş. ("Company"), domiciled at Burhaniye Mahallesi, Atilla Sokak No: 7-1 Üsküdar / İstanbul, as the data controller, in accordance with the Law No. 6698 on the Protection of Personal Data ("Law") as described below.

YOUR PROCESSED PERSONAL DATA

Identity Information: Name, Surname, Turkish Republic Identity Number (TCKN), Mother's Name, Father's Name, Date of Birth, Place of Birth, Marital Status, Province of Registration, District, Neighborhood, Village, Identity Image, Marriage Certificate Image, Passport Image, Driver's License Image, Signature
Contact Information: Mobile Phone Number, Email Address, Residential Address, Workplace Address, Proof of Residence
Legal Proceedings: Correspondence with judicial authorities, litigation file information, death certificate
Customer Transactions: Invoice, IBAN, Account Transactions, Customer Card Number, Payments Made and Received, Invoice, Promissory Note, Check, Receipt, Purchase History, Account Transactions, Payment Instruction Information, balance, transaction limit, risk information
Transaction Security: IP Address, internet login and logout information, password information
Visual and Audio Records: Photograph, Video Recording, Audio Recording
Demographic Data: Profession

PURPOSES OF PROCESSING PERSONAL DATA AND LEGAL BASIS FOR PROCESSING

Data Processing Purposes	Personal Data Categories	Legal Basis
Establishment of Payment Service Agreement in a Valid Manner	Identity Information Contact Information	-Directly related to the establishment or performance of the agreement -Necessary for the company to fulfill its legal obligations -Explicitly provided in the laws
Providing and Executing User Account Opening	Identity Information Contact Information Customer Transaction	-Directly related to the establishment or performance of the agreement -Necessary for the company to fulfill its legal obligations
Conversion of Papara Account to Verified Account Status	Identity Information Contact Information Customer Transaction	-Directly related to the establishment or performance of the agreement -Necessary for the company to fulfill its legal obligations
Sending and Loading Money to the Account	Identity Information Customer Transaction	-Directly related to the establishment or performance of the agreement -Necessary for the company to fulfill its legal obligations -Explicitly provided in the laws
Receiving and Tracking User Requests and Complaints,	Identity Information Contact Information Customer Transaction	-Directly related to the establishment or performance of the agreement -Necessary for the company to fulfill its legal obligations -Explicitly provided in the laws
Conducting User Identity Verification for This Purpose	Visual and Audio Records Identity Information	-Explicit Consent
Refunding to the User	Identity Information Contact Information Customer Transaction	-Directly related to the establishment or performance of the agreement -Necessary for the company to fulfill its legal obligations Explicitly provided in the laws
Announcing, Promoting, and Advertising Campaigns and Products within the Scope of Services Provided by Papara, Customer Relationship Management for These Purposes	Identity Information Contact Information Customer Transaction	Necessary for the legitimate interests of the data controller
Execution of Business Models and Marketing Analysis Studies for Business Development	Identity Information Contact Information Demographic data	Necessary for the legitimate interests of the data controller
Tracking Legal Affairs	Identity Information Contact Information Customer Transaction Legal Transaction	-Necessary for the company to fulfill its legal obligations -Explicitly provided in the laws -Necessary for the establishment, use, or protection of a right -Necessary for the legitimate interests of the data controller
Prevention of Abuse, Loss, Fraud, Execution of Transaction and Information Security Processes	Identity Information Contact Information Customer Transaction Legal Transaction	Necessary for the company to fulfill its legal obligations Explicitly provided in the laws
Execution of Risk Management, Internal Control, and Compliance Processes	Identity Information Contact Information Customer Transaction Legal Transaction	Necessary for the company to fulfill its legal obligations Explicitly provided in the laws
Execution of Storage and Archiving Processes	Identity Information Contact Information Customer Transaction Legal Transaction	Necessary for the company to fulfill its legal obligations Explicitly provided in the laws

METHODS OF COLLECTING YOUR PERSONAL DATA

Face-to-face meetings,
Call center interactions,
E-mails sent to our business units,
Membership applications and complaints made via social media,
Membership applications made through our website and mobile application,
Transmission by our partner banks for user transactions,
Representative offices facilitating the establishment of contractual relationships.

TRANSFER OF PROCESSED PERSONAL DATA

Your personal data may be shared domestically with the following third parties, in connection with the purposes listed above, in a limited and proportionate manner:

Public institutions and regulatory authorities (such as the Central Bank of the Republic of Turkey, MASAK, Ministry of Treasury and Finance, Revenue Administration, Ministry of Trade) as required by payment systems-related legislation,
Our business partners for conducting payment service activities (such as printing user cards, obtaining information systems services, courier and cargo companies),
Banks for conducting fraud prevention/investigation processes within the scope of legislation,
Consultants and law firms providing support in legal processes,
Courts and consumer arbitration boards, Enforcement Offices, Law Enforcement Agencies for the execution of legal processes,
Organizations providing KYC (Know Your Customer) services within the scope of legislation,
External service providers for the development of control services,
Invoice payment organizations for unpaid invoice collection,
Independent audit firms,
Our business partners for the provision of IT services within the scope of our activities. Your personal data will not be transferred abroad.

RIGHTS OF THE DATA SUBJECT

You have the following rights regarding your personal data in accordance with the relevant legislation:

- To learn whether your personal data is processed or not,

- If your personal data has been processed, to request information regarding this processing,

- To learn the purpose of the processing of personal data and whether they are used in accordance with their purpose,

- To know the third parties to whom your personal data is transferred domestically or abroad,

- If your personal data is incomplete or inaccurate, to request their correction,

- Within the framework of the conditions stipulated in the relevant legislation, to request the deletion or destruction of your personal data,

- If your personal data is corrected, deleted, or destroyed upon your request, to request that this situation be notified to the third parties to whom your personal data has been transferred,

- To object to the occurrence of a result against you by solely analyzing the processed data through automated systems,

-If you suffer any damages due to the unlawful processing of personal data, to request the compensation of your damages.

HOW LONG WILL YOUR PERSONAL DATA BE RETAINED?

Your personal data will be retained for the period required by laws in accordance with the purposes of collection. We act in accordance with the criteria we have determined for the specific retention periods of personal data categories. After the expiry of the period, your personal data will be deleted, anonymized, or destroyed.

CHANGES TO THE PRIVACY NOTICE

This privacy notice may be updated by the Company from time to time. In case of any significant changes to the privacy notice, necessary notifications will be made to you via email or other means.

HOW TO APPLY AND COMPLAIN ABOUT YOUR PERSONAL DATA?

You can submit your applications regarding your rights listed above to us by filling out the "Personal Data Owner Application Form on [www.papara.com] website, signing it with a secure electronic signature, and sending it to our email address kisiselveri@papara.com along with the necessary identification information, or by sending the wet-signed copy of this form personally, through a notary, or by registered mail to "Burhaniye Mahallesi, Atilla Sokak, No:7-1, Üsküdar / İstanbul" address. In case a third party submits the application on behalf of the data subject, a power of attorney duly issued by a notary must be submitted additionally.

Papara declares and undertakes to respond to your application within thirty days at the latest by providing a written response free of charge in accordance with the provisions of the Law. However, if the transaction requires an additional cost, Papara reserves the right to charge the fee specified in the tariff determined by the Board.

In case the application of the data subject is rejected, found insufficient, or not responded to within the specified period, the data subject has the right to lodge a complaint with the Board within thirty days from the date of learning the response and in any case within sixty days from the application date, in accordance with Article 14 of the Law.

You can contact our Company via kisiselveri@papara.com for your requests. Depending on the nature of your request, your applications will be responded to as soon as possible and within thirty days at the latest.