Papel Commercial Customer Clarification Text

September 26, 2024

Papel Elektronik Para ve Ödeme Hizmetleri Anonim Şirketi ("Our Company" or "Papel"), residing at Maslak Mah. Eski Büyükdere Cad. Link Plaza Sitesi Link Plaza Blok No: 3-5 Interior Door No: 33 Sarıyer/İstanbul, as the data controller, may process, transfer, and store your general or special categories of personal data within the framework of the following purposes and conditions in accordance with the Personal Data Protection Law No. 6698 ("KVKK"). This Papel POS Customer Clarification Text on the Protection and Processing of Personal Data ("Clarification Text") has been prepared to inform Papel POS ("POS") users about how and why we collect, process, store, and transfer your personal data and to whom and for what reason.

1. Methods of Collection of Personal Data

In the following cases, we may collect your personal data:

From you, from the information and documents you have submitted to Papel,
Through the website, our call centre, public platforms, or through other persons and institutions we have contracted with,
Through authorised public institutions and organisations, digitally or physically, in written, verbal, or voice recording form, automatically or non-automatically:

Examples include:

(i) When you contact us via our customer service or other communication channels,
(ii) When you apply for Papel POS,
(iii) Through the contracts, instructions, information, and documents you submit, your payment order instructions, and the applications you use when you become a Papel POS Customer.

2. Processed Personal Data

Papel will process your personal data for the purposes specified in this Clarification Text. In case of any change in your personal data and/or purposes, Papel will update this Clarification Text and publish the current version separately.

The personal data collected and used by Papel include:

Data Category	Personal Data
Identity Data	Name-surname, previous surname, Turkish ID number, date of birth, identity information on identity card and/or driving licence, company partners' information, VKN, customer title, Foreigner ID number.
Contact Data	Telephone number, e-mail, address of the applicant, workplace address, workplace/mobile phone number, mobile phone, and e-mail address of the card customer.
Financial Data	Customer's IBAN and card number information, bank account information.
Audio and Visual Data	Voice recording data.
Occupational Data	Job and occupational data.
Customer Transaction Data	Call centre voice recordings, past transaction records, invoice information.
Marketing Data	Information obtained through marketing activities.
Legal Transaction Data	KVKK and IYS permission, judicial administrative authority requests.

3. Purposes of Processing Personal Data

Your personal data may be processed using automatic or non-automatic methods for the following purposes in accordance with applicable legislation and KVKK:

(i) To fulfil our legal obligations as stipulated in laws, including Law No. 6493 on Payment and Securities Settlement Systems, Payment Services, and Electronic Money Institutions, and the Law No. 5651 on Regulation of Publications on the Internet and Combating Crimes Committed through These Publications.
(ii) To ensure the establishment and performance of the contract by accepting the framework agreement regarding the payment service offered by Papel.
(iii) Completing the registration stages, creating users and accounts, carrying out customer and identity verification processes, and ensuring secure access to the Papel POS panel.
(iv) Benefiting from the products and services offered by Papel, making informative and guiding communications, and providing information on transactions and transaction follow-up.
(v) Carrying out finance and accounting transactions, keeping current accounts, and following up processes to ensure financial reconciliation.
(vi) Storing information as required by the legislation, copying and backing up information to prevent data loss, ensuring accuracy and consistency, and conducting audit activities.
(vii) Ensuring information and operational security, assessing, determining, and managing risk levels, performing suspicious transaction and user controls, and taking necessary actions in inappropriate situations.
(viii) Keeping systematic records, reporting, planning and conducting analyses, and strategy and business development processes.
(ix) Receiving complaints, opinions, suggestions, and error notifications; providing guidance and evaluating customer feedback.
(x) Sharing with regulatory authorities to fulfil legal obligations, follow up on contractual processes, and address legal requests.
(xi) Performing internal purposes such as quality control, call centre operations, and coordination among company units.
(xii) Informing you about changes in company policies and procedures.
(xiii) Detecting, preventing, and investigating suspicious or unlawful transactions.
(xiv) Ensuring the security of our Company's electronic systems and physical environments.

Additional purposes (with explicit consent):

(i) Conducting data, customer, and marketing analysis, creating campaigns, and contacting you about these campaigns.
(ii) Collecting satisfaction information through questionnaires, searches, and forms.
(iii) Assigning the most suitable service package.
(iv) Improving your user experience by customizing business processes based on your usage habits.
(v) Transferring data to service providers for the purposes listed above.

4. Legal Grounds for Processing Personal Data

We process your personal data only if there is a valid legal reason in accordance with the KVKK and, if necessary, with your explicit consent. The legal grounds for processing your data include:

Explicitly stipulated in the laws: In compliance with the provisions of Law No. 6493, Law No. 5549, and their secondary regulations.
Establishment and Performance of the Contract: To fulfil obligations arising from the agreement.
Fulfilment of Legal Obligations: Compliance with regulations that impose obligations on Papel.
Presence of Legitimate Interest: Processing data for efficient and effective POS payment services without harming your fundamental rights and freedoms.
Necessity for the Establishment, Exercise or Protection of a Right: When processing is mandatory.
Publicised by the Relevant Person: Processing data you have made public.
Explicit Consent: For purposes requiring explicit consent, such as marketing and customer analysis.

5. Transfer of Personal Data to Third Parties

Your personal data may be transferred to group companies, shareholders, authorised institutions, suppliers, affiliates, and official institutions (e.g., Central Bank of Turkey, Revenue Administration, Public Prosecutor's Offices) for the purposes specified in Article 3, provided necessary security measures are in place. Third parties may process your data only for the purpose of transfer, unless otherwise regulated.

With your explicit consent, personal data in the categories of identity, communication, customer transaction, finance, and marketing may be transferred to domestic and foreign service providers for marketing, campaigns, and product promotion.

6. Your Rights as a Personal Data Owner

Pursuant to Article 11 of the KVKK, you have the right to:

(i) Learn whether your data is being processed.
(ii) Request information on processed data.
(iii) Learn the purpose of data processing and its use.
(iv) Know the third parties to whom your data is transferred domestically or abroad.
(v) Request correction of incomplete or incorrect data.
(vi) Request deletion or destruction of data when processing reasons no longer exist.
(vii) Request notification of correction and deletion to third parties to whom data was transferred.
(viii) Object to adverse results through automated data analysis.
(ix) Demand compensation for damages due to unlawful data processing.

Submitting a Request: If you wish to exercise your rights, you may submit your request by:

Mail: "Maslak Mah. Eski Büyükdere Cad. Link Plaza Site Link Plaza Block No: 3-5 Interior Door No: 33 Sarıyer/İstanbul" in person or through a notary.
Registered Electronic Mail (KEP): To "papelelektronik@hs01.kep.tr".
Email: To "destek@papel.com.tr" using secure electronic signature, mobile signature, or previously notified email.

Sincerely,
Papel Elektronik Para ve Ödeme Hizmetleri Anonim Şirketi